Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/17/2020
02:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

CISA: SolarWinds Not the Only Initial Attack Vector in Massive Breach

Agency says it has "evidence of additional initial access vectors" besides SolarWinds' Orion software.

In yet another twist to the recently revealed major cyber espionage campaign waged by apparent Russian nation-state actors, SolarWinds' network management platform was not the only initial infection vector for the sophisticated attacks, according to the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA).

CISA revealed that juicy tidbit today in a cyber activity alert that calls the attacks a "grave risk" to government agencies, critical infrastructure organizations, and the private sector. The SolarWinds Orion network management platform initially was thought to be the main attack vector; the attackers injected malware into the SolarWinds application, so when users installed an update, they were infected with the stealthy code.

Related Content:

Concerns Run High as More Details of SolarWinds Hack Emerge

Building an Effective Cybersecurity Incident Response Team

New From The Edge: Why Secure Email Gateways Rewrite Links (and Why They Shouldn't)

"CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated. CISA will update this Alert as new information becomes available," the agency said in the report.

The agency is investigating incidents where victims were compromised in the same campaign but without the malicious Orion code. They also point to security vendor Volexity's report of a think tank that was compromised via an attack that bypassed Duo and other multifactor authentication to reach its Outlook Web App.

"Volexity attributes this intrusion to the same activity as the SolarWinds Orion supply chain compromise, and the TTPs are consistent between the two. This observation indicates that there are other initial access vectors beyond SolarWinds Orion, and there may still be others that are not yet known," CISA said. 

Duo, meanwhile, said the incidents described in the Volexity report "were not due to any vulnerability in Duo's products." The attacker was able to gain privileged access to the OWA integration credentials from "within an existing compromised customer environment, such as an email server," according to Duo.

CISA reiterated the seriousness of the overall attack campaign: "This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks. Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans."

The attack first was exposed earlier this month when FireEye revealed it had detected a breach that also pilfered its red-team tools.

Read more here

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23381
PUBLISHED: 2021-04-18
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374
PUBLISHED: 2021-04-18
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23375
PUBLISHED: 2021-04-18
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23376
PUBLISHED: 2021-04-18
This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23377
PUBLISHED: 2021-04-18
This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.