Global cybersecurity firm FireEye that faced a data breach last week has revealed that hackers believed to be operating on behalf of a foreign government breached software provider SolarWinds and then deployed a malware in its Orion software to infect multiple US companies and government networks, including itself.
The revelation came after the Washington Post reported on Sunday that a hacker group backed by the Russian government is behind data breaches at the Treasury and Commerce departments and other US government agencies.
The group, known as APT29, or Cozy Bear, is also behind the attack on FireEye, accessing its internal network and stealing hacking tools the company uses to test the networks of its customers.
According to FireEye, the global hacking campaign introduced a compromise into the networks of public and private organizations through the software supply chain.
“This compromise is delivered through updates to a widely-used IT infrastructure management software — the Orion network monitoring product from SolarWinds. The campaign demonstrates top-tier operational tradecraft and resourcing consistent with state-sponsored threat actors,” said Kevin Mandia, FireEye CEO.
The attacks required meticulous planning and manual interaction.
“We believe it is critical to notify all our customers and the security community about this threat so organizations can take appropriate steps, FireEye said in a statement late on Sunday, adding that the company has updated its products to detect the known altered SolarWinds binaries.
In a separate security advisory, SolarWinds said the attack was likely conducted by an outside nation state and intended to be a narrow, extremely targeted, and manually executed attack, as opposed to a broad, system-wide attack.
“We are recommending you upgrade to Orion Platform version 2020.2.1 HF 1 as soon as possible to ensure the security of your environment. The latest version is available in the SolarWinds Customer Portal”.
However, neither FireEye nor SolarWinds revealed how many customers were impacted due to the attack.
“We are working to investigate the impacts of this incident and will continue to update you as we are made aware of any interruptions or impact to your business specifically,” SolarWinds said.
Microsoft has named the malware Solorigate and added detection rules to its Defender antivirus. FireEye has named the malware SUNBURST.
–IANS