Hackers Exploit VPN to Deploy SUPERNOVA malware on SolarWinds Orion

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
has disclosed details of a new advanced persistent threat (APT)
that’s leveraging the Supernova backdoor to compromise SolarWinds
Orion installations after gaining access to the network through a
connection to a Pulse Secure VPN^[1]
device.

“The threat actor connected to the entity’s network via a Pulse
Secure virtual private network (VPN) appliance, moved laterally to
its SolarWinds Orion server, installed malware referred to by
security researchers as SUPERNOVA^[2]
(a .NET web shell), and collected credentials,” the agency said^[3]
on Thursday.

CISA said it identified the threat actor during an incident
response engagement at an unnamed organization and found that the
attacker had access to the enterprise’s network for nearly a year
through the use of the VPN credentials between March 2020 to
February 2021.

Interestingly, the adversary is said to have used valid accounts
that had multi-factor authentication (MFA) enabled, rather than an
exploit for a vulnerability, to connect to the VPN, thus allowing
them to masquerade as legitimate teleworking employees of the
affected entity.

In December 2020, Microsoft disclosed^[4]
that a second espionage group may have been abusing the IT
infrastructure provider’s Orion software to drop a persistent
backdoor called Supernova on target systems. The intrusions have
since been attributed to a China-linked threat actor called
Spiral^[5].

Unlike Sunburst and other pieces of malware that have been
connected to the SolarWinds compromise, Supernova is a .NET web
shell implemented by modifying an
“app_web_logoimagehandler.ashx.b6031896.dll” module of the
SolarWinds Orion application. The modifications were made possible
by leveraging an authentication bypass vulnerability in the Orion
API tracked as CVE-2020-10148^[6], in turn allowing a
remote attacker to execute unauthenticated API commands.

An investigation into the incident is ongoing. In the meantime,
CISA is recommending organizations to implement MFA for privileged
accounts, enable firewalls to filter unsolicited connection
requests, enforce strong password policies, and secure Remote
Desktop Protocol (RDP) and other remote access solutions.