FBI, CISA, NSA Officially Blame Russia for SolarWinds Cyber Attack

The U.S. government on Tuesday formally pointed fingers at the
Russian government for orchestrating the massive SolarWinds supply chain attack^[1] that came to light early
last month.

“This work indicates that an Advanced Persistent Threat (APT)
actor, likely Russian in origin, is responsible for most or all of
the recently discovered, ongoing cyber compromises of both
government and non-governmental networks,” the Federal Bureau of
Investigation (FBI), the Cybersecurity and Infrastructure Security
Agency (CISA), the Office of the Director of National Intelligence
(ODNI), and the National Security Agency (NSA) said^[2]
in a joint statement.

Russia, however, denied^[3]
any involvement in the operation on December 13, stating it “does
not conduct offensive operations in the cyber domain.”

The FBI, CISA, ODNI, and NSA are members of the Cyber Unified
Coordination Group (UCG), a newly-formed task force put in place by
the White House National Security Council to investigate and lead
the response efforts to remediate the SolarWinds breach.

A Much Smaller Number Compromised

Calling the campaign an “intelligence gathering effort,” the
intelligence bureaus said they are currently working to understand
the full scope of the hack while noting that fewer than 10 U.S.
government agencies were impacted by the compromise.

The names of the affected agencies were not disclosed, although
previous reports have singled out the U.S. Treasury, Commerce,
State, and the Departments of Energy and Homeland Security among
those that have detected tainted SolarWinds’ network management
software installations, not to mention a number of private entities
across the world.

An estimated 18,000 SolarWinds customers^[4] are said to have
downloaded the backdoored software update, but the UCG said only a
smaller number had been subjected to “follow-on” intrusive activity
on their internal networks.

Microsoft’s analysis^[5]
of the Solorigate modus operandi last month found that the
second-stage malware, dubbed Teardrop, has been selectively
deployed against targets based on intel amassed during an initial
reconnaissance of the victim environment for high-value accounts
and assets.

The joint statement also confirms previous speculations that
linked the espionage operation to APT29^[6]
(or Cozy Bear), a group of state-sponsored hackers associated with
the Russian Foreign Intelligence Service (SVR).

The hacking campaign was notable for its scale and stealth^[7], with the attackers
leveraging the trust associated with SolarWinds Orion software to
spy on government agencies and other companies for at least nine
months, including viewing source code^[8]
and stealing security tools^[9], by the time it was
discovered.

SolarWinds Faces Class Action Lawsuit

Meanwhile, SolarWinds is facing further fallout after a
shareholder of the IT infrastructure management software company
filed a class-action lawsuit^[10] in the U.S. District
Court for the Western District of Texas on Monday against its
president, Kevin Thompson, and chief financial officer, J. Barton
Kalsu, claiming the executives violated federal securities laws
under the Securities Exchange Act of 1934.

The complaint states that SolarWinds failed to disclose that
“since mid-2020, SolarWinds Orion monitoring products had a
vulnerability that allowed hackers to compromise the server upon
which the products ran,” and that “SolarWinds’ update server had an
easily accessible password of ‘solarwinds123’,” as a result of
which the company “would suffer significant reputational harm.”