aol.pm

SolarWinds Compromise

Campaign · ATTACK:enterprise:C0024

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:C0024",
  "title": "SolarWinds Compromise",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0024",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--808d6b30-df4e-4341-8248-724da4bac650",
  "external_id": "C0024",
  "domain": "enterprise",
  "created": "2023-03-24T14:59:26.744Z",
  "modified": "2026-07-31T18:47:25.784Z",
  "version": "1.1",
  "aliases": [
    "SolarWinds Compromise"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Volexity SolarWinds",
      "url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"
    },
    {
      "source_name": "CrowdStrike StellarParticle January 2022",
      "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
    },
    {
      "source_name": "USG Joint Statement SolarWinds January 2021",
      "url": "https://www.cisa.gov/news-events/news/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure"
    },
    {
      "source_name": "FireEye SUNBURST Backdoor December 2020",
      "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
    },
    {
      "source_name": "Mandiant UNC2452 APT29 April 2022",
      "url": "https://www.mandiant.com/resources/blog/unc2452-merged-into-apt29"
    },
    {
      "source_name": "MSTIC NOBELIUM May 2021",
      "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
    },
    {
      "source_name": "Microsoft Internal Solorigate Investigation Blog",
      "url": "https://msrc-blog.microsoft.com/2021/02/18/microsoft-internal-solorigate-investigation-final-update/"
    },
    {
      "source_name": "Microsoft Analyzing Solorigate Dec 2020",
      "url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
    },
    {
      "source_name": "NSA Joint Advisory SVR SolarWinds April 2021",
      "url": "https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF"
    },
    {
      "source_name": "SolarWinds Advisory Dec 2020",
      "url": "https://www.solarwinds.com/sa-overview/securityadvisory"
    },
    {
      "source_name": "SolarWinds Sunburst Sunspot Update January 2021",
      "url": "https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/"
    },
    {
      "source_name": "UK NSCS Russia SolarWinds April 2021",
      "url": "https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise"
    },
    {
      "source_name": "Unit 42 SolarStorm December 2020",
      "url": "https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/"
    }
  ]
}

Explicit source assertions (83)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1606.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00e7784e-d0c8-48d8-a377-7ec83cf6a474

Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks · Secureworks IRON RITUAL Profile

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00fe17bc-f783-4cba-9171-e1fde2fa0efa

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--081a9ee3-3609-4bab-8956-d0bd2b77754a

Volexity SolarWinds · CrowdStrike SUNSPOT Implant January 2021 · FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09cc5150-b68e-45de-9172-5fec7623c9ac

CrowdStrike StellarParticle January 2022 · Secureworks IRON RITUAL Profile

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0588

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--111d5f78-f5d3-4c33-b5f8-d978c166b52a

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--177d06e3-7e2f-47a1-8bbf-18a4787af5c7

CrowdStrike StellarParticle January 2022 · Symantec RAINDROP January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1980e913-a4dc-415c-a98d-df1a20e001f2

Volexity SolarWinds · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19baa7ba-5fdd-405e-996c-13e49299cbfb

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a1d72d9-3dd3-410d-99cc-ada6def874ff

Volexity SolarWinds · CrowdStrike StellarParticle January 2022 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1584.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2389113c-9a72-4633-aa52-8f77c3df564a

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1016.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a764532-6758-4a82-90e4-eb53d1ac9c16

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1550

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a8a7397-8977-4554-abbf-5168074cd4cc

Microsoft 365 Defender Solorigate · Secureworks IRON RITUAL Profile

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cac54a6-fe28-45b2-b4f7-53a23f8a5f54

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37213eca-1510-4893-b27a-f17a8dd16a78

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--378bf726-1fd4-4c08-939a-88fb11405205

CheckPoint Sunburst & Teardrop December 2020 · FireEye SUNBURST Backdoor December 2020 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--378bf78e-6c5c-4466-9d6b-a494ae375526

Volexity SolarWinds · Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:C0024 → attributed-to → ATTACK:enterprise:G0016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b2680f0-aa69-4766-ab41-9123373ffa4e

Mandiant UNC2452 APT29 April 2022 · NSA Joint Advisory SVR SolarWinds April 2021 · UK NSCS Russia SolarWinds April 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1665

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41ce73bb-344d-4078-8e4a-4a6f52b8616e

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0589

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--427b9f61-9f58-4167-b4f5-c7f3bdbd7862

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1098.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b0b60ee-2ee8-4de0-868f-ae4c85e131ff

Volexity SolarWinds · MSTIC Nobelium Oct 2021 · Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b6f2524-85b4-4151-9001-32b875cfbb19

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1213

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5377ce7e-ae13-4902-a7f9-98e83d04808b

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57d595d2-4363-4816-826e-91e45dd364e5

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59fd7bfd-f99b-4a76-9ea0-4fc89c27f204

Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1568

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67cf9a5c-3ecf-4280-9808-a027680f7444

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1589.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68b21708-d862-42ba-8067-7fdca0bd1455

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6934c7b5-96ce-4265-aea3-7eae018d7f3c

Microsoft 365 Defender Solorigate · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ce6e5d1-a9e1-43bb-a296-e6bd188081f4

CrowdStrike SUNSPOT Implant January 2021 · FireEye SUNBURST Backdoor December 2020 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73622af3-6412-4fb9-b0ba-6a127c0db558

Symantec RAINDROP January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73b90f6c-b64d-4b7b-8142-b02f52e8cea1

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1685.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--740cb688-3a2d-46fb-88de-6fbd61045889

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0597

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--743a12d9-9260-4761-b158-7a697fd43e42

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--755e4d65-4e9f-499c-93f3-2aa9a9404000

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1069

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7657acc8-12ba-4e39-a739-011674d94f58

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7748c6c9-d7a5-44e9-81bf-97d038e6edb1

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1021.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7779c4b8-d007-439a-81b7-b56efb8742ea

Symantec RAINDROP January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1550.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b2cc5e3-11c3-4620-a787-04f2273bcbb8

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d8a984d-676d-47bf-a660-00c43ab49985

CrowdStrike StellarParticle January 2022 · Microsoft 365 Defender Solorigate

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1098.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80e8fae3-0b15-4e5b-bd69-af76dd3e5864

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84c18662-07de-4abc-99e2-f2bfb19cc5da

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0682

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b52c2d4-8e40-42c7-9661-7d5fb58b3af5

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cba1710-1963-4d83-99dd-88a1d6b2580f

Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1546.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e8aced5-9391-47d8-bef7-894453048810

Microsoft 365 Defender Solorigate · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9171c149-2e87-4882-9e9d-8abce7533beb

Volexity SolarWinds · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1213.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93dc5023-3f2b-41a3-bd5a-68121a94280d

Microsoft Internal Solorigate Investigation Blog

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94380550-1855-4032-8635-9e19e5616903

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--949cf89d-6d65-4459-83e7-dc826ae9c894

Volexity SolarWinds · CrowdStrike StellarParticle January 2022 · Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9505cb0b-a9b6-4680-94ed-ae74916444f0

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95add276-6a4d-4281-82e5-7857b615742b

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1606.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97ce46f9-4277-4700-99bb-b8bad6dfb393

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1550.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b03dca3-8d3f-42a6-9df1-44fdd732d393

Volexity SolarWinds · CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1074.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9eb8df35-0cbf-490e-903a-f610a1387eb2

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1098.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a05709f5-d61c-40cf-8fdc-d821eafce194

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0c23dc4-d3ad-4312-a10c-001e7040a32b

CrowdStrike StellarParticle January 2022 · MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a246ff9a-6414-461f-b392-ac37bc3716c0

CrowdStrike StellarParticle January 2022 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4346806-c7aa-4fa4-896d-a279ceeaf487

Volexity SolarWinds · Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4a0c78e-6f15-4304-9e40-36c09a532a05

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1558.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa84d43a-4f79-485c-95ea-a375d5f52838

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0562

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afd398cc-b093-429c-88f5-e7f661567fd1

CrowdStrike SUNSPOT Implant January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1643345-ab99-4648-ab15-0af7219978f1

CrowdStrike StellarParticle January 2022 · Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b16660dc-0675-462a-85fc-1902a751639e

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b426f4dd-2d0d-49d1-bbb3-82508df979a4

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4fad2c0-1407-4409-af5d-2cd098a1e536

FireEye SUNBURST Backdoor December 2020 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5234d9f-a581-4bcd-9441-2c1d111f3ce8

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb886759-3494-4834-9765-2f0c12e0b391

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbc492bf-de7c-4ef7-ba1b-565ec0f22379

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdc492d0-220c-4588-8361-a92dc79c4ba0

CheckPoint Sunburst & Teardrop December 2020 · FireEye SUNBURST Backdoor December 2020 · Microsoft Deep Dive Solorigate January 2021 · FireEye SUNBURST Additional Details Dec 2020 · SolarWinds Sunburst Sunspot Update January 2021 · Symantec Sunburst Sending Data January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1003.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c34b776e-2fca-4ff9-910d-486bf9447d78

CrowdStrike StellarParticle January 2022 · Microsoft 365 Defender Solorigate · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb7005a8-0c69-4f5f-b14c-aae0c8e2cced

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1098.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd4655ac-8e31-4272-a944-9bf54074d3a0

CrowdStrike StellarParticle January 2022 · Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf0b7d7d-0770-4b97-86ff-cbb5ec19bb83

Volexity SolarWinds · CrowdStrike StellarParticle January 2022 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d398f48c-9d01-4f6e-bb19-3ebae25cb71c

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da68887e-3811-4537-90b1-21d42a90e960

Microsoft 365 Defender Solorigate · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1195.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dba2e83b-a79b-4d4e-8c32-70b7c8f2491f

FireEye SUNBURST Backdoor December 2020 · Microsoft Deep Dive Solorigate January 2021 · Cybersecurity Advisory SVR TTP May 2021 · SolarWinds Sunburst Sunspot Update January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1070.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e30d2085-62df-4c4a-9828-a9b6d5396136

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1484.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e43b9163-36cb-469a-9c47-9e4bd8af1383

Microsoft 365 Defender Solorigate · Secureworks IRON RITUAL Profile

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0565

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7f2fab9-7a97-4892-9fee-fe9b98c8f0a0

Microsoft Deep Dive Solorigate January 2021 · Symantec RAINDROP January 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eab4fb13-01cc-4d7c-87a8-dc52e172dfab

MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ecdd1bee-29eb-4f72-a506-6c33777a094f

Volexity SolarWinds

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f059a1ec-1945-43b7-ba0c-0d304c5b6d74

FireEye SUNBURST Backdoor December 2020 · MSTIC NOBELIUM Mar 2021 · Cybersecurity Advisory SVR TTP May 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.