The US-based IT company SolarWinds confirmed that its network management system, Orion Platform, was exploited to conduct a highly sophisticated, manual supply-chain attack. According to SolarWinds, a threat actor obtained access to the company’s systems and implanted malicious code into Orion software builds. Approximately 18,000 SolarWinds customers then installed malicious Orion updates that enabled the attacker to deploy a backdoor, dubbed SUNBURST or Solarigate, into victims’ systems and steal information. It is highly likely that a state-sponsored threat actor/group is responsible but, at the time of writing, there is not enough information to confirm this. Although the attacker’s motives and future intentions are not clear, they will likely use stolen information to conduct additional attacks in the short-term future (one to three months).
The notorious Automated Vending Cart (AVC) website Joker’s Stash allegedly displayed a notification that th...
Want To Try Our Digital Risk Protection Tool?Get Started Free
Other content in this Stream
The People’s Republic of China-linked advanced persistent threat group “APT31” reportedly cloned and deployed a zero-day exploit developed by NSA's Equation Group in 2013.
Initial Access Brokers: A Deep Dive - Webinar Feb 2021
An unidentified attacker accessed the computer systems of a water treatment facility in the US, altering sodium hydroxide levels in the potable water supply.
Following the disclosure of the SolarWinds supply-chain compromise in December 2020, details continue to emerge about the scale of the attack.
The North Korean advanced persistent threat (APT) group “ZINC” has been targeting cyber-security professionals with social engineering that leads to malware delivery.
A new web portal is aiding cyber-threat incident responders by detailing vulnerabilities in popular malware.
This guide draws from best practices suggested in SearchLight’s playbooks, so security professionals can improve their tools and processes to prevent employee account takeover.
Technical analysis of a cyber-threat campaign using the dangerous and widespread “Lokibot” malware has revealed an updated method being used to conduct sophisticated attacks.
A cyber-security firm released a free decryptor for the popular and sophisticated “DarkSide” ransomware.
The cyber-security industry learned some valuable lessons during the unique and unprecedented year of 2020.
The notorious Automated Vending Cart (AVC) website Joker’s Stash allegedly displayed a notification that the site was seized by law-enforcement agencies.
A global spearphishing campaign targeted organizations associated with a COVID-19 vaccine cold chain.
In this session, Digital Shadows will share their insights and assessments into what we can expect to see in 2021.
A threat actor recently hijacked a vulnerable WordPress website set up by a security researcher.
The operators of the “RagnarLocker” ransomware began an advertising campaign on Facebook to further extort the victim of one of their recent attacks.
“CostaRicto” has become the fourth cyber-mercenary group to be discovered in 2020.
The North Korean cyber-threat group “Kimsuky” has caught the attention of the US Cybersecurity and Infrastructure Security Agency (CISA), having proved itself a significant advanced persistent threat.
In this session, Digital Shadows will analyze and expand on reported ransomware attacks and delve into how security teams can strengthen their operations.
The developers of the infamous “Maze” ransomware claimed to have permanently ceased operations.