thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

SUNBURST

The backdoor inserted into SolarWinds Orion software updates in a 2020 supply chain attack.

Definition

Attackers attributed to Russia's SVR (APT29) compromised SolarWinds' build process and signed trojanized Orion updates containing SUNBURST. The backdoor lay dormant for up to two weeks, then used DGA-style subdomains for C2 and selectively delivered follow-on malware to high-value targets such as US government agencies.

Example

A signed SolarWinds.Orion.Core.BusinessLayer.dll making DNS queries to avsvmcloud.com subdomains.

Exam tip

Code signing does not prevent supply chain compromise if the build process itself is breached.

Related terms