{"id":38711,"date":"2020-12-15T16:41:00","date_gmt":"2020-12-15T16:41:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/trojan-in-solarwinds-security-has-far-reaching-impact\/"},"modified":"2020-12-15T16:41:00","modified_gmt":"2020-12-15T16:41:00","slug":"trojan-in-solarwinds-security-has-far-reaching-impact","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/trojan-in-solarwinds-security-has-far-reaching-impact\/","title":{"rendered":"Trojan in SolarWinds security has far-reaching impact"},"content":{"rendered":"
<\/div>\n

SolarWinds says a compromise of its widely used Orion network-monitoring platform endangers the networks of public and private organizations that use it and that the problem should be remediated right away.<\/p>\n

In a security advisory<\/a>, SolarWinds said customers should upgrade to Orion Platform version 2020.2.1 HF 1 as soon as possible to ensure their environment is safe. An additional hotfix release that both replaces the compromised component and provides several additional security enhancements is expected in the next day or two.<\/p>\n

The company\u2019s managed services tools appear to be uncompromised, and the company said it isn\u2019t aware of any similar issues with its non-Orion products, like RMM, N-Central, and SolarWinds MSP products.<\/p>\n

FireEye, which discovered the compromise<\/a>, said it has updated its scanning software to watch for known altered SolarWinds Orion binaries. In addition, Microsoft said its Defender security software has been updated<\/a> to detect malicious code and has issued its own security guidance<\/span><\/a> along with extensive research of the Trojan causing the problem.<\/p>\n

FireEye\u2019s CEO Kevin Mandia wrote in his blog that the attack was likely carried out by a nation. \u201cThe campaign demonstrates top-tier operational tradecraft and resourcing consistent with state-sponsored threat actors,\u201d he wrote. He did not identify the actors, but Reuters said it was the work of Russian hackers.<\/p>\n

Orion is part of the SolarWinds suite of network and computer management tools that includes monitoring capabilities and the ability to automatically restart services. The compromise means the attackers can bypass the security, install malicious content and restart infected systems without anyone knowing it.<\/p>\n