Solar Winds Supply Chain attack have also discovered a second threat actor that has exploited the SolarWinds software to plant malicious software on corporate and Government networks.
Continue reading
Some SolarWinds systems were found damaged due to a malicious software known by the name of Supernova and CosmicGale, which were not related to the recent supply chain attack.
Security researchers while investigating the Solar Winds Supply Chain attack have also discovered a second threat actor that has exploited the SolarWinds software to plant malicious software on corporate and Government networks.
Details about this second threat actor are still not sufficient enough but security researchers are not ready to believe that the second one is related to the suspected Russian Government-backed hackers who violated SolarWinds to insert malicious software inside its official Orion application.
Security researchers assured the public by confirming that the attackers were using the Supernova web shell to download, compile and execute a malicious Powershell script known as CosmicGale by some.
However analyzing from Microsoft's security teams, statements confirm that the Supernova web shell was not part of the original attack chain.
Companies that find Supernova on their SolarWinds installations need to cater this incident as a separate attack.
Recent reports claim that the Supernova web shell appears to be planted on SolarWinds Orion installations that have been left exposed online and a balance has been made with exploits similar to a threat tracked as CVE-2019-8917.
The confusion that Supernova was related to the Sunburst+Teardrop attack chain came from the fact that just like Sunburst, Supernova was asserted as a DLL for the Orion application.
But investigations on December 18, Microsoft confirmed that unlike the Sunburst DLL, the Supernova DLL was not signed with a legal SolarWinds digital certificate.
Backdoor.Daxin, the kernel-mode rootkit Symantec once called the most advanced tool ever tied to a China-linked espionage actor, has been found running again
