/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

SolarWinds: When the Software Update Is the Attack

Case Studies  · 1,487 words · 7 min read · by QiO:~$ ·

SolarWinds: When the Software Update Is the Attack

A trusted, digitally signed update delivered the backdoor, and nobody noticed for most of a year.

Austin, Texas-based SolarWinds is one of the world's largest producers of IT management software, providing management solutions to both private industry and government agencies. In December 2020, as the year raged on amidst Covid-19 lockdowns and a U.S. Presidential election, SolarWinds announced what would become one of the largest and most consequential security breaches in history. The breach would compromise government agencies, corporations, and critical infrastructure. The attackers' identity turned out to be less of a mystery than it first seemed: in April 2021, the U.S. government formally blamed Russia's Foreign Intelligence Service (SVR) and announced sanctions in response. What is clear is that this breach was wide-ranging, and incredibly consequential in the landscape of cyber security, information technology, and data security.

How It Happened

Hackers first got into SolarWinds' network in September 2019. By October they were testing how to inject malicious code, and in February 2020 they inserted the Sunburst backdoor into builds of SolarWinds' Orion software, which is used for network monitoring and IT management. In late March 2020, SolarWinds unknowingly began distributing the compromised updates to its customers. Specifically, to carry out the attack, hackers modified an Orion platform plugin distributed as part of Orion platform updates which was digitally signed by SolarWinds and contained a backdoor that communicated with third-party servers under the attackers' control (Zscaler). Once the attackers established a foothold in impacted organizations, they could steal data, deploy malicious code, or otherwise disrupt business. The malicious code went undetected until December 2020, and nearly 18,000 SolarWinds customers received a compromised update. In the systems they chose to pursue, the attackers could deploy additional malware, allowing the hack to expand far beyond the initial compromise.

The cyber security firm FireEye is widely credited with the initial discovery of the hack. In early December 2020, FireEye announced that intruders had stolen its security testing tools. While investigating that theft, the company found that SolarWinds' software had been compromised as well.

The Damage

With the breach affecting both private and public organizations, the consequences were wide-ranging and incredibly serious. The SolarWinds hack allowed access to sensitive personal data, internal corporate communications, as well as potentially classified government information. Agencies like DHS, the U.S. Treasury and the Dept. of Commerce were compromised, while corporate interests like Microsoft, Intel and Cisco were also affected. In total, nine government agencies and about 100 companies were breached. The United States Government Accountability Office sums up the hack on its website: of the nearly 18,000 customers who received a compromised update, the threat actor targeted a smaller subset of high-value customers, including the federal government, primarily for espionage. Although SolarWinds released patches to fix the Orion update vulnerability, the breach was so widespread and far-ranging that it is hard to be certain it ever fully ended. There may be persistent backdoors hidden away inside the systems of SolarWinds customers, though nothing public confirms that. It may still take some time before the final scope of the SolarWinds hack is fully known (Oladimeji and Kerner).

The Response

Information about the exact internal response by SolarWinds is hard to come by. Of course, this could be by design for security reasons, or it could be legal strategy, since the company spent years in litigation with the SEC (more on that below). SolarWinds released security patches, and Microsoft, FireEye and GoDaddy took over the command-and-control domain used by the Sunburst backdoor and turned it into a kill switch. Information about the federal response is readily available. According to the Government Accountability Office, the White House's National Security Council established a unified coordination group (UCG) on December 16, 2020, made up of the FBI, CISA and ODNI, with support from the NSA. The UCG worked together to guide agency response, provide intelligence and release information to the public.

Responsibility, and the SEC

It is obvious that SolarWinds had a massive responsibility, not only to its corporate customers, but as a contractor serving United States government agencies, it has a responsibility to the public at large. With great power (and great financial gain) comes great responsibility. Having the privilege to serve such a large and important customer base comes with the highest of standards. It should go without saying that an information technology company who contracts with the Federal Government should guard its security relentlessly and follow established practices and regulations or be prepared to suffer the wrath of said Federal Agencies if things go wrong.

The SEC argued SolarWinds had not done this. In October 2023, it charged both SolarWinds and its CISO, Timothy G. Brown, with fraud and internal control failures, alleging they downplayed cyber risks to investors from the company's October 2018 IPO through the December 2020 attack disclosure. The complaint alleged that SolarWinds was under persistent cyberattack and had discovered vulnerabilities that were far more serious than it acknowledged publicly or to investors. Internal documents cited by the SEC suggest that engineers and employees raised blunt concerns about the company's security posture.

Those were allegations, and they didn't hold up. In July 2024, Judge Paul Engelmayer dismissed most of the SEC's case, including every claim tied to the attack itself, which he found relied on hindsight and speculation. He also ruled that cybersecurity controls fall outside the accounting controls the SEC had invoked. Only claims about a "Security Statement" on SolarWinds' website survived. In November 2025, the SEC voluntarily dismissed the rest of the case against SolarWinds and Brown, with prejudice. The SEC's press release paints a damning picture of a company that may have known its defenses were weaker than advertised, but no court ever found that to be true.

A Textbook Supply-Chain Hack

The SolarWinds hack is a textbook supply-chain hack, and highlights the risks associated with third-party vendors. Today, you will find top-level management software in almost every type of large business. In fact, third-party software and applications exist in nearly everything these days. Even your browser may be secure, but can you really trust that free VPN extension? Probably not. At the corporate level, this takes on an even larger element of risk. When a company like SolarWinds, whose software is used by tens of thousands of organizations, suffers a breach, it can quickly spiral out of control. Any company offering such a sensitive application must operate with security as the centerpiece of its mission. To do anything less is unethical and poses great risk.

The SolarWinds incident also brings into question the practice of globally integrating systems to the point where a single breach or hack can cripple systems worldwide. In July of 2024, cyber security firm CrowdStrike pushed a faulty update that crashed an estimated 8.5 million Windows devices, grounding flights and sending the cyber security industry into a panic. A fix went out within 79 minutes, but recovery took far longer because many machines needed hands-on repair. Unlike SolarWinds, this was not an attack. CrowdStrike's root cause analysis pointed to a faulty content validator and missing safety checks. I'll admit I had my doubts about CrowdStrike's explanation, though nothing public contradicts it, but I digress... Regardless of what happened, when taken into consideration with SolarWinds, should we be asking questions about how distributed such systems have become? Should we allow entire industries or government agencies to use the same vendor? Should firewalls not be built inside these systems so that a hack at the top-level cannot easily propagate through compromised updates from company to company? Are we building a digital world out of a house of cards? These are all important questions.

Takeaway

The uncomfortable lesson of SolarWinds is that a trusted, signed update looks identical to a malicious one. Many customers did exactly what they were told to do: install the vendor's update. That is what made the attack so effective.

Improved supply chain management is critical moving forward, and real questions about how we allow these systems to be built and used should be addressed to avoid massive incidents like the SolarWinds hack in the future.

Sources

Read next

The Importance of Ethics in Cyber Security