CISA: Unplug systems using compromised net monitoring tool
Connecting state and local government leaders
The Cybersecurity and Infrastructure Security Agency issued an emergency directive in response to a sophisticated cyberattack mandating all federal civilian agencies stop using SolarWinds' Orion products "immediately."
In response to a sophisticated cyberattack on internal emails systems at the Departments of Treasury and Commerce, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive in mandating all federal civilian agencies stop using SolarWinds' Orion products "immediately."
The attackers – likely backed by Russia, according to analysts and government sources – are believed to gained access through updates to the Orion products by using a “supply chain attack,” which hides malicious code software updates provided to targets by third parties, Reuters said in the first report of the attack. A subsequent Reuters report said the Department of Homeland Security has also been hit by the attackers.
SolarWinds, which provides IT management and monitoring products, boasts a long list of government customers including the Defense Department, NASA and the National Security Agency as well as "425 of the U.S. Fortune 500" companies," according to company's website,
"The compromise of SolarWinds' Orion Network Management Products poses unacceptable risks to the security of federal networks," CISA acting Director Brandon Wales said. The "directive is intended to mitigate potential compromises within federal civilian networks, and we urge all our partners -- in the public and private sectors -- to assess their exposure to this compromise and to secure their networks against any exploitation."
CISA also said that federal agencies using SolarWinds products should provide a completion report to the CISA by noon Monday.
The news hit several days after FireEye announced its own network was compromised and cyber exploits used to test client networks were stolen.
"Our analysis indicates that these compromises are not self-propagating," FireEye CEO Kevin Mandia wrote in a Dec. 13 blog post. "Each of the attacks require meticulous planning and manual interaction"
SolarWinds said the hackers likely exploited a vulnerability in a patch released earlier this year.
"We are aware of a potential vulnerability which if present is currently believed to be related to updates which were released between March and June 2020 to our Orion monitoring products," Kevin Thompson, the company's president, said in a statement.
"We are acting in close coordination with FireEye, the Federal Bureau of Investigation, the intelligence community, and other law enforcement to investigate these matters. As such, we are limited as to what we can share at this time," he continued.
An FBI spokesman said the agency is aware of the breach but declined to comment further.
In a Sunday night post, FireEye said it is tracking the actors behind the "global intrusion campaign" using malware the company named SUNBURST. The company said the campaign, which it named UNC2452, has gained access to "numerous" public and private organizations around the world.
"This campaign may have begun as early as Spring 2020 and is currently ongoing," according to the FireEye post. "The campaign is the work of a highly skilled actor and the operation was conducted with significant operational security."
FireEye said SUNBURST uses a backdoor that initially remains dormant for up to weeks after being delivered. The malware gives the attacker ranging authority over compromised systems, including the ability to transfer riles, run programs and disabling services. The malware allows the attacker to "blend in with legitimate SolarWinds activity," according to FireEye's post.
Former CISA director Chris Krebs tweeted Sunday night that anyone who uses Orion should assume they're compromised.
"Immediately activate your incident response team. Odds are you're not affected, as this may be a resource intensive hack. Focus on your Crown Jewels. You can manage this," he said.
This article was first posted to FCW, a sibling site to GCN.