The SolarWinds compromise, revealed in December 2020, is one of the most important cyber espionage operations ever made public. Attackers slipped a backdoor into a trusted IT management product and used its update mechanism to reach thousands of organizations. This cyber warfare case study explains how the attack worked, who it affected, how it was attributed and what defenders learned.
Timeline
| Date | Event |
|---|---|
| September 2019 | Attackers access SolarWinds’ environment and test code injection |
| February 2020 | The SUNSPOT implant starts inserting the backdoor during software builds |
| March to June 2020 | Trojanised Orion updates ship to customers |
| 8 December 2020 | FireEye discloses that attackers stole its red-team tools |
| 13 December 2020 | FireEye and SolarWinds reveal the Orion backdoor (SUNBURST) |
| 13 December 2020 | CISA issues Emergency Directive 21-01 to disconnect Orion |
| 15 April 2021 | The US and UK formally attribute the operation to Russia’s SVR |
How the attack worked
1. Compromising the build system
The attackers did not simply change source code in a repository. Instead, they planted a tool called SUNSPOT on SolarWinds’ build servers. It quietly swapped in malicious code while Orion was being compiled, and then removed the evidence.
2. Shipping a signed backdoor
The tampered builds carried SolarWinds’ valid digital signature. As a result, customers trusted the updates. Around 18,000 organizations installed affected versions of Orion, released between March and June 2020.
3. Waiting and blending in
The SUNBURST backdoor stayed dormant for up to two weeks. Then it contacted attacker servers using traffic designed to look like normal Orion communications, and it avoided systems with certain security tools.
4. Selecting high-value targets
The attackers activated follow-on access for only a small fraction of victims. Reports indicated about 100 private companies and nine US federal agencies. In those networks, they moved laterally, abused identity systems, forged authentication tokens and read email, including cloud mailboxes.
Who was affected
Targets included US government departments, technology companies such as Microsoft, FireEye and other security vendors, and organizations in Europe, Asia and the Middle East. The goal appears to have been intelligence collection, not destruction.
Attribution
On 15 April 2021, the US and UK governments attributed the operation to Russia’s Foreign Intelligence Service (SVR). Security researchers track the group as APT29, also called Cozy Bear or Midnight Blizzard. The US also announced sanctions in response.
Why it counts as cyber warfare
The operation did not cause physical damage. However, it was a state-run campaign against government and strategic targets, using a technique that put entire supply chains at risk. It showed how cyber espionage can compromise national security in peacetime. For context, see what is cyber warfare.
Consequences
- Governments launched investigations and emergency response efforts.
- US Executive Order 14028 (May 2021) pushed software supply chain security, including software bills of materials (SBOMs).
- The US SEC sued SolarWinds and its CISO in 2023; a court dismissed most of the claims in July 2024.
- Supply chain security frameworks, such as SLSA, gained wide adoption.
Lessons for organizations
- Treat suppliers as part of your attack surface. Review critical vendors’ build and update security.
- Limit what monitoring tools can reach. Tools like Orion need broad access, so segment and monitor them closely.
- Watch identity systems. Token forging and abuse of cloud identities were central to the attack.
- Monitor outbound traffic. Unusual connections from servers can reveal backdoors.
- Keep good logs. Investigators needed months of logs to rebuild events.
- Plan for “trusted” compromises. Assume a signed update could be malicious, and have a response plan.
Related guides
Sources
Worried about targeted attacks on your business? Our VAPT services find weaknesses before attackers do, and our OSINT investigations show what is exposed about your organisation online. Contact us for a quote.
