Table of Contents

For guidance on the solarwinds issue please see DHS , SolarWinds , FireEYE , MSRC , and Microsoft .

Advanced users, please see the FireEYE Countermeasures Repo on this issue.

SANS has a good video on the topic here .

Executables:

The DLL in question is SolarWinds.Orion.Core.BusinessLayer.dll and was signed as a ligitimate part of the SolarWinds suite, bypassing application control technologies. It is installed as a service.

The malicious code was injected into a legitimate DLL and is loaded into memory when the application runs. The code runs before the legitimate code. According to Microsoft, the code is activated when SolarWinds.BusinessLayerHost.exe executable runs, but may the following may also load it:

  • ConfigurationWizard.exe
  • NetflowDatabaseMaintenance.exe
  • NetFlowService.exe
  • SolarWinds.Administration.exe
  • SolarWinds.BusinessLayerHost.exe
  • SolarWinds.Collector.Service.exe
  • SolarwindsDiagnostics.exe

Network information:

General Ranges:

  • DNS CNAMEs for C2:
    • .appsync-api.eu-west-1[.]avsvmcloud[.]com
    • .appsync-api.us-west-2[.]avsvmcloud[.]com
    • .appsync-api.us-east-1[.]avsvmcloud[.]com
    • .appsync-api.us-east-2[.]avsvmcloud[.]com
  • IP Ranges for C2:
    • 20.140.0.0/15
    • 96.31.172.0/24
    • 131.228.12.0/22
    • 144.86.226.0/24

Specifically Identified:

  • DNS Names associated with C2:
    • 6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud[.]com
    • 7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud[.]com
    • gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud[.]com
    • ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud[.]com
    • k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud[.]com
    • mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud[.]com
  • IPs assosciated with C2:
    • 13.59.205.66
    • 54.193.127.66
    • 54.215.192.52
    • 34.203.203.23
    • 139.99.115.204
    • 5.252.177.25
    • 5.252.177.21
    • 204.188.205.176
    • 51.89.125.18
    • 167.114.213.199

DLL Locations :

  • C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\Solarwinds\Network Topology Mapper\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\Solarwinds\Network Topology Mapper\Service\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\DPI\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\NCM\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\Interfaces.Discovery\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\DPA\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\HardwareHealth\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\Interfaces\SolarWinds.Orion.Core.BusinessLayer.dl
  • C:\Program Files (x86)\SolarWinds\Orion\NetFlowTrafficAnalysis\SolarWinds.Orion.Core.BusinessLayer.dll
  • C:\Program Files (x86)\SolarWinds\Orion\NPM\SolarWinds.Orion.Core.BusinessLayer.dll

Microsoft Malicious DLL Table:

FireEYE Indicator Table:

Sites Known to Be Hit By SunBurst/SolarFlare: