** We will update this article with additional information as it becomes available. We have also published a playbook to guide any security team that has SolarWinds in their environment and is looking to initiate incident response. **
Last updated: [2020-12-18 22:35 UTC] – view changelog
SolarWinds, an IT monitoring specialist, reported last Sunday that it had fallen victim to a “highly-sophisticated, manual supply chain attack … likely by a nation state.”
The compromised products are SolarWinds Orion versions 2019.4 through 2020.2.1.
How to identify if you are running an impacted SolarWinds Orion version?
Sophos customers can identify whether they are running a vulnerable version in multiple ways:
Sophos MTR customers
The MTR team is actively monitoring all protected customer environments and has already contacted affected customers directly to discuss remedial action.
Sophos EDR customers
EDR customers can run the dedicated query below to hunt for affected versions (updates will be posted here):
SELECT name, version, install_location, publisher, uninstall_string, install_date FROM programs where name like 'SolarWinds Orion%2020.2' or name like 'SolarWinds Orion%2020.2.1%' or name like 'SolarWinds Orion%2019.4%';
Additionally, EDR customers can look for the following malicious DLL SHA256 hashes:·
Anyone not using Sophos EDR can activate a 30-day free trial and run the query across your estate:
- If you are already running Sophos Central, activate the free trial directly within your console. Under ‘MORE PRODUCTS’ in the main navigation select ‘Free Trials’ and then select Intercept X Advanced with EDR, Intercept X Advanced for Server with EDR, or both.
- If you not running Sophos Central, activate a free trial from our website.
All Sophos customers
SophosLabs has published the following anti-malware detections for the compromised SolarWinds components:
If you see one or more of these detections, you are exposed to potential attack.
SophosLabs has also published the following detections for the known second-stage backdoor components:
If you see one or more of these detections, you are likely a victim of targeted attack and should take additional remediation actions.
Warning: check your configuration for scan exclusions. See https://twitter.com/ffforward/status/1338785034375999491
SophosLabs is in the process of releasing IPS signatures that identify Command-and-Control traffic from the active exploitation stages of the attack. The list of IPS signatures to monitor on Sophos XG Firewall is:
- 56662 – MALWARE-CNC Win.Backdoor.Sunburst inbound connection attempt
- 56660 – MALWARE-CNC Win.Backdoor.Sunburst outbound connection attempt
- 56665 – MALWARE-CNC Win.Backdoor.Sunburst outbound connection attempt
- 56661 – MALWARE-CNC Win.Backdoor.Sunburst outbound connection attempt
If you see one or more of these IPS detections, you are likely a victim of targeted attack and should take additional remediation actions.
We have blocked all associated IP and domain indicators.
We have also revoked trust on the compromised SolarWinds certificate used in these attacks.
Sophos Application Control detects all versions of SolarWinds Orion as “SolarWinds MSP Agent”. Application Control is an optional setting – read the Help Guide for instructions on how to enable it, and add SolarWinds to the list of apps you want to block.
SophosLabs is continuing to investigate the attack and will be providing additional protection as necessary. Please monitor this location for further updates.
What do to if you are impacted
If you are running a compromised version, we recommend that you isolate the affected SolarWinds servers from the network.
We also recommend rebuilding all impacted SolarWinds servers and installing Orion Platform version 2020.2.1 HF 2 which is now available. See https://www.solarwinds.com/securityadvisory for more details.
We will be releasing further incident response guidance shortly. Contact your security team or partner for advice and support where needed.
Sophos and SolarWinds
2020-12-18 22:35 UTC Updated “Sophos and SolarWinds” section
2020-12-18 16:28 UTC Updated “Sophos EDR customers” section with new malicious DLL SHA256 hashes.
2020-12-16 14:03 UTC Added Troj/SunBurst-A to anti-malware detections
2020-12-16 12:40 UTC Updated to state that Orion Platform version 2020.2.1 HF 2 is now available
2020-12-16 12:27 UTC Updated to advise that the Sophos MTR team has now contacted all affected MTR customers
2020-12-15 22:04 UTC Added Sophos detection names for second-stage backdoor components and XG IPS signatures for command and control traffic
2020-12-15 21:00 UTC Added additional Sophos detections; add an additional Hash; add signatures to monitor for
2020-12-15 12:24 UTC Added warning to check your configuration for exclusions
2020-12-15 12:06 UTC Added link to Application Control help guide, and to advise that Application Control is an optional setting that needs to be enabled.
2020-12-15 09:30 UTC Updated to add Mal/Sunburst-A to the list of Sophos detections; provide the Sophos AppControl detection; advise that we have blocked all associated IPs and domain indicators; add three further Hashes; and provide link to the playbook.
2020-12-14 18:54 UTC Updated to advise that SophosLabs has revoked trust on the compromised SolarWinds certificate used in these attacks