Article
APT29 (Cozy Bear): Russia’s Stealth Espionage Powerhouse
APT29 (Cozy Bear, The Dukes, Midnight Blizzard) is attributed by the US and UK to Russia's SVR. Aliases, targets, operations and defences.
Read more
Significant cyber incident
SolarWinds Orion supply chain compromise
In short
The SolarWinds Orion supply chain compromise was disclosed in December 2020, when attackers were found to have put a backdoor into Orion network monitoring updates released between March and June 2020. SolarWinds believed fewer than 18,000 customers had an affected installation. On 15 April 2021 the US government attributed the campaign to the Russian Foreign Intelligence Service (SVR). Removal was described as highly complex.
What happened
On 13 December 2020 CISA issued Emergency Directive 21-01, ordering federal civilian agencies to disconnect or power down SolarWinds Orion versions 2019.4 through 2020.2.1 HF1. The next day SolarWinds told the SEC that a cyberattack had inserted a vulnerability into Orion updates released between March and June 2020, through a compromise of its software build system.
SolarWinds said fewer than 18,000 of its customers may have had an installation with the vulnerability. On 5 January 2021 the Cyber Unified Coordination Group (FBI, CISA and ODNI, with NSA support) said a much smaller number had been compromised by follow-on activity, and that it had identified fewer than ten US government agencies in that group. It also said an APT actor, likely Russian in origin, was responsible and that the aim was intelligence gathering.
On 15 April 2021 the White House formally named the SVR as the perpetrator. Treasury said victims included the financial sector, critical infrastructure and government networks. CISA also reported initial access that did not involve Orion, such as password guessing and weakly secured administrative accounts.
Timeline
-
March to June 2020
Orion updates containing the vulnerability are released (SolarWinds, 8-K).
-
At least March 2020
CISA dates the earliest compromises of government, critical infrastructure and private organizations to this month.
-
Spring and summer 2020
SVR operators use modified SolarWinds software to widen access to numerous networks (FBI and CISA advisory).
-
13 December 2020
SolarWinds sends a notice to about 33,000 Orion customers. CISA issues Emergency Directive 21-01.
-
14 December 2020
SolarWinds files its SEC Form 8-K describing the compromise of the Orion build system.
-
15 December 2020
The command domain used by the backdoor is redirected to an address on a Microsoft blocklist.
-
16 December 2020
The FBI, CISA and ODNI announce the Cyber Unified Coordination Group.
-
5 January 2021
The Unified Coordination Group says an APT actor, likely Russian in origin, is responsible and gives the scale.
-
6 January 2021
CISA updates alert AA20-352A with other initial access vectors and cloud and SAML techniques.
-
15 April 2021
The US formally names the SVR. Treasury sanctions follow, ten diplomatic personnel are expelled, and NSA, CISA and FBI issue an advisory.
How the attack worked
Step 1: Poisoning the software build
SolarWinds said the vulnerability came from a compromise of the Orion software build system and was not in the source code repository. CISA says the adversary added a malicious version of an Orion library (DLL) into the software lifecycle, and that it was signed with the genuine SolarWinds code signing certificate. CISA lists this as Supply Chain Compromise (T1195.002).
Step 2: Quiet contact with the attacker
Once installed, the library called out to a victim-specific domain using a protocol designed to look like normal SolarWinds traffic. The attacker could use the DNS reply to send back new domains or IP addresses for interactive control. CISA noted that contact with the domain alone did not prove follow-on action, and that not every victim was targeted further.
Step 3: Using Orion’s privileges
CISA says Orion is often given pervasive privileges, which made it a valuable target. The actor used virtual private servers, often with IP addresses in the victim’s home country, to blend in with normal traffic.
Step 4: Forged identity and cloud access
CISA reports that the actor stole SAML signing certificates using Active Directory privileges, then created valid tokens that services in the environment trusted. It also added credentials to existing Azure and Microsoft 365 application service principals to keep access. The FBI and CISA describe a shift from malware to cloud resources, particularly email, and say the actors targeted accounts of IT staff.
Other ways in
CISA found victims that did not use Orion or where Orion was not abused. In some cases initial access came from password guessing, or from weakly secured administrative credentials (Valid Accounts, T1078) reached through external remote access services (External Remote Services, T1133).
- Build system compromisedAttackers add a malicious library to Orion updatesTechnique T1195.002 (MITRE ATT&CK, opens in a new tab)
- Signed update shippedThe library carries the genuine SolarWinds signature and reaches customers
- Backdoor calls homeIt contacts a victim-specific domain in traffic made to look normal
- Selective controlDNS replies send chosen victims to interactive control servers
- Identity theftSAML signing certificates and service principal credentials are abused
- Cloud email accessValid tokens give access to email, including IT staff accounts
ATT&CK techniques
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Who attributed it, and how firm it is
SolarWinds, 14 December 2020: advised the incident was likely a supply chain attack by an outside nation state; it had not independently verified the identity.
Cyber Unified Coordination Group (FBI, CISA, ODNI, NSA), 5 January 2021: an APT actor, likely Russian in origin, is responsible for most or all of the compromises.
White House, 15 April 2021: attributed by the US government to the Russian Foreign Intelligence Service (SVR), also known as APT 29, Cozy Bear and The Dukes, with high confidence from the Intelligence Community. CISA updated its emergency directive and alert with the same attribution on 15 April 2021.
Treasury, 15 April 2021: says the SVR is responsible for the 2020 exploit of the Orion platform. No official source opened here gives a court finding.
Impact
SolarWinds, 14 December 2020: fewer than 18,000 customers may have had an installation with the vulnerability, out of about 33,000 notified. Orion was about 45 percent of revenue in the first nine months of 2020.
Cyber Unified Coordination Group, 5 January 2021: about 18,000 affected customers, a much smaller number compromised by follow-on activity, and fewer than ten US government agencies identified.
White House, 15 April 2021: the access gave the SVR the ability to spy on or potentially disrupt more than 16,000 computer systems worldwide.
Treasury, 15 April 2021: thousands of US government and private sector networks were compromised, including the financial sector, critical infrastructure and government networks. The SVR also stole red team tools from a US cyber security company.
The figures differ by source (18,000, 16,000, thousands) because they count different things: installations, systems and compromised networks. Sources do not give a single total of victims or a cost.
Government and regulator response
- 13 December 2020, CISA: Emergency Directive 21-01 ordered federal agencies to disconnect or power down Orion, treat monitored hosts as compromised, rebuild them and reset credentials used by or stored in Orion.
- 13 to 14 December 2020, SolarWinds: notified about 33,000 customers, offered a hotfix, filed an SEC Form 8-K, and said it was cooperating with the FBI and intelligence community.
- 15 December 2020: the backdoor’s command domain was redirected to an address on a Microsoft blocklist, which stops new use of the implant. Infections already moving past the first contact would likely continue.
- 16 December 2020: the FBI, CISA and ODNI formed a Cyber Unified Coordination Group. NSA supported it.
- January 2021, CISA: published a free detection tool and updated alert AA20-352A.
- 15 April 2021, US government: formal attribution to the SVR, expulsion of ten Russian diplomatic personnel, Treasury designation of six Russian technology companies, and a joint NSA, CISA and FBI advisory on SVR activity.
Lessons
-
Trusted updates can carry the attack
The malicious library was signed with the genuine SolarWinds certificate, so a valid signature did not prove the code was safe.
-
Monitoring tools hold the keys
CISA notes Orion is often given pervasive privileges. A tool that sees everything is also a high-value target.
-
Identity is a second front
The actor forged SAML tokens and added credentials to cloud application accounts. Patching the product did not remove that access.
-
Logs and behavior caught some of it
Some victims stopped follow-on activity by auditing logs for access to privileged certificates and fake identity providers, and by watching for encoded PowerShell.
-
Removal is slow
CISA expected removal to be highly complex, and the emergency directive told agencies to rebuild monitored hosts and reset credentials.
-
Not every victim used the vector
CISA found intrusions at organizations that did not run Orion, through password guessing and weak admin credentials. Fix basic access controls too.
What to check in your own organization
-
Inventory of management tools
List every network monitoring, patching and backup tool with admin reach, and who can change what it deploys.
-
Update trust
Decide how you verify vendor updates beyond the signature, and whether high-privilege tools get staged rollout and network limits.
-
Outbound traffic from servers
Check that management servers can only reach the destinations they need, and alert on unexpected DNS lookups from them.
-
Token and certificate handling
Protect SAML signing certificates, audit changes to federation trusts, and check for unexpected credentials on cloud application service principals.
-
Cloud sign-in review
Look for impossible travel and unusual token lifetimes, as CISA describes, in your identity logs.
-
Admin accounts and MFA
Confirm every administrative account is covered by multi-factor authentication and has no exemptions, and watch for password spraying.
-
Mailbox of IT staff
Treat the mailboxes of IT and incident response staff as targets, and plan how you respond if attackers can read them.
Where it happened
- Industry Technology and SaaS Hijacked build tools, poisoned packages, stolen developer logins and leaked keys at software companies, and the rules that apply.
- Country United States This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America
Questions
What is the SolarWinds Orion compromise?
In 2020 attackers inserted a backdoor into Orion software updates through SolarWinds' build system. SolarWinds disclosed it in an SEC filing on 14 December 2020, a day after CISA ordered US federal agencies to disconnect Orion.
How many organizations were hit?
SolarWinds believed fewer than 18,000 customers had an affected installation. The US Unified Coordination Group said a much smaller number were compromised by follow-on activity, including fewer than ten US government agencies.
Who was behind it?
The US government attributed it to the Russian Foreign Intelligence Service (SVR), also known as APT 29, on 15 April 2021, with high confidence from the Intelligence Community.
What did the attackers want?
The Unified Coordination Group said on 5 January 2021 that it believed this was an intelligence gathering effort. CISA said the initial objective appeared to be collecting information.
Did every victim get the backdoor through Orion?
No. CISA found other initial access vectors, including password guessing and weakly secured administrative credentials.
How did the US respond?
CISA issued Emergency Directive 21-01, a Unified Coordination Group was formed, and on 15 April 2021 the US named the SVR, sanctioned technology companies and expelled ten diplomatic personnel.
In our research
- APT29 (Cozy Bear): Russia’s Stealth Espionage Powerhouse September 2025
- APT29 Threat group
Sources
- SolarWinds Corp Form 8-K, 14 December 2020 SolarWinds Corporation / U.S. Securities and Exchange Commission
- Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise CISA
- Alert AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations CISA
- Joint Statement by the FBI, CISA and ODNI (16 December 2020) CISA
- Joint Statement by the FBI, CISA, ODNI and NSA (5 January 2021) CISA
- Fact Sheet: Imposing Costs for Harmful Foreign Activities by the Russian Government (15 April 2021) The White House (archived)
- Treasury Sanctions Russia with Sweeping New Sanctions Authority U.S. Department of the Treasury
- Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders FBI, DHS and CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.