theDocumentId => 1339755 CISA: SolarWinds Not the Only Initial Attack Vector ...

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:00 PM
Connect Directly

CISA: SolarWinds Not the Only Initial Attack Vector in Massive Breach

Agency says it has "evidence of additional initial access vectors" besides SolarWinds' Orion software.

In yet another twist to the recently revealed major cyber espionage campaign waged by apparent Russian nation-state actors, SolarWinds' network management platform was not the only initial infection vector for the sophisticated attacks, according to the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA).

CISA revealed that juicy tidbit today in a cyber activity alert that calls the attacks a "grave risk" to government agencies, critical infrastructure organizations, and the private sector. The SolarWinds Orion network management platform initially was thought to be the main attack vector; the attackers injected malware into the SolarWinds application, so when users installed an update, they were infected with the stealthy code.

Related Content:

Concerns Run High as More Details of SolarWinds Hack Emerge

Building an Effective Cybersecurity Incident Response Team

New From The Edge: Why Secure Email Gateways Rewrite Links (and Why They Shouldn't)

"CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated. CISA will update this Alert as new information becomes available," the agency said in the report.

The agency is investigating incidents where victims were compromised in the same campaign but without the malicious Orion code. They also point to security vendor Volexity's report of a think tank that was compromised via an attack that bypassed Duo and other multifactor authentication to reach its Outlook Web App.

"Volexity attributes this intrusion to the same activity as the SolarWinds Orion supply chain compromise, and the TTPs are consistent between the two. This observation indicates that there are other initial access vectors beyond SolarWinds Orion, and there may still be others that are not yet known," CISA said. 

Duo, meanwhile, said the incidents described in the Volexity report "were not due to any vulnerability in Duo's products." The attacker was able to gain privileged access to the OWA integration credentials from "within an existing compromised customer environment, such as an email server," according to Duo.

CISA reiterated the seriousness of the overall attack campaign: "This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks. Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans."

The attack first was exposed earlier this month when FireEye revealed it had detected a breach that also pilfered its red-team tools.

Read more here

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-07-28
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
PUBLISHED: 2021-07-28
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
PUBLISHED: 2021-07-28
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192957.