Log in Request a demo

Malware profile

SUNBURST

Also known as Solorigate

SUNBURST is a trojanized Windows DLL built to fit inside the SolarWinds Orion software update framework.

In short

SUNBURST is a trojanized Windows DLL built to fit inside the SolarWinds Orion software update framework. CISA describes it as a backdoor that lets a remote operator run functions on the system, deploy more payloads and exfiltrate data. In April 2021 the US and UK governments attributed the SolarWinds compromise to Russia's Foreign Intelligence Service (SVR).

Last updated 9 October 2026

Profile MapMalware
  1. Names2names in public reportsSUNBURST · Solorigate
  2. Techniques18ATT&CK techniques listedCommand And Control · Execution · Discovery
  3. Infection Steps5in the delivery chainBuild compromise · Delivery
  4. Linked Groups1groups that use itAPT29

In one minute

What it is
A trojanized Windows DLL inside the SolarWinds Orion software update framework, described by CISA as a backdoor.
What it does
Lets a remote operator run functions on the system, deploy more payloads and exfiltrate data. It talks to its operators over HTTP and DNS and stays quiet if it detects certain security software.
Who uses it
Attributed by the US Government (CISA advisory update and Treasury, 15 April 2021) and by the UK NCSC, which assesses it as highly likely, to Russia's Foreign Intelligence Service (SVR), also known as APT29. MITRE also lists APT29.
How it gets in
A SolarWinds Orion software update carrying the trojanized DLL, signed with the real SolarWinds certificate. CISA also found other ways in that did not use Orion.
What to do first
Check whether the affected Orion versions (2019.4 through 2020.2.1 HF1) were ever installed, then use the indicators and detection rules in CISA report AR21-039A and advisory AA20-352A.

What it does

SUNBURST hid inside a real SolarWinds Orion component. CISA explains that network administrators often give Orion wide privileges, which makes it a valuable target.

Not every organization that received the backdoor was targeted next. CISA says some had no follow-on actions from the attacker.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
SUNBURSTMITRE ATT&CK software S0559 and CISA malware analysis report AR21-039A[1, 3]
SolorigateMITRE ATT&CK Associated Software[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Command And Control

  • Application Layer Protocol: Web Protocols T1071.001

    It sent its command traffic to third party servers using HTTP GET or POST requests.[1]

  • Application Layer Protocol: DNS T1071.004

    It used DNS for command traffic that was made to look like normal SolarWinds API communications.[1]

  • Dynamic Resolution T1568

    It looked up its command servers through randomly generated subdomains under one parent domain.[1]

  • Encrypted Channel: Symmetric Cryptography T1573.001

    It hid its command traffic with a single-byte XOR cipher.[1]

  • Data Encoding: Standard Encoding T1132.001

    It used Base64 encoding in its command traffic.[1]

  • Data Obfuscation: Protocol or Service Impersonation T1001.003

    It made its network traffic look like the Orion Improvement Program protocol.[1]

  • Data Obfuscation: Steganography T1001.002

    It tried to make its command data look like harmless XML about .NET assemblies or a fake JSON blob.[1]

  • Ingress Tool Transfer T1105

    It delivered other payloads, and MITRE names TEARDROP in at least one case.[1]

Execution

  • Command and Scripting Interpreter: Visual Basic T1059.005

    It used VBScripts to start the execution of payloads.[1]

Discovery

  • Software Discovery: Security Software Discovery T1518.001

    It checked for several antivirus and endpoint detection agents before it ran.[1]

  • Process Discovery T1057

    It listed process names, hashed them and compared them to hashed blocklists.[1]

  • System Information Discovery T1082

    It collected the host name and the operating system version.[1]

Stealth

  • Virtualization/Sandbox Evasion: Time Based Checks T1497.003

    It stayed dormant after the first access for up to two weeks.[1]

  • Obfuscated Files or Information T1027

    It hid the system information it collected with an FNV-1a and XOR scheme.[1]

  • Indicator Removal: File Deletion T1070.004

    It had a command to delete files.[1]

Defense Impairment

  • Subvert Trust Controls: Code Signing T1553.002

    It was signed by SolarWinds between March and May 2020.[1]

  • Disable or Modify Tools T1685

    It tried to disable security services after checking them against a hashed blocklist.[1]

Privilege Escalation

  • Event Triggered Execution: Image File Execution Options Injection T1546.012

    It set an IFEO debugger value for dllhost.exe to trigger the installation of Cobalt Strike.[1]

How it spreads

CISA says a malicious version of an Orion DLL was added into the SolarWinds software lifecycle and signed with the real SolarWinds code signing certificate. CISA's analysis report says it was delivered as part of certain SolarWinds updates and installed by the legitimate installer. Emergency Directive 21-01 gives the affected Orion versions as 2019.4 through 2020.2.1 HF1. CISA also says the same actor had other ways in that did not use Orion, such as password guessing and password spraying.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Build compromise

    A malicious version of an Orion DLL was added into the SolarWinds software lifecycle and signed with the legitimate SolarWinds code signing certificate.[2]

  2. Delivery

    The trojanized DLL was delivered as part of certain SolarWinds updates and installed by the legitimate installer.[3]

  3. Quiet period

    MITRE says SUNBURST stayed dormant for up to two weeks. CISA's report says it will not run if it detects certain security software.[1, 3]

  4. First check-in

    Once installed, the DLL calls out to a victim-specific domain, using a protocol designed to look like real SolarWinds traffic.[2]

  5. Selective follow-on

    After the check-in, the actor can use the DNS response to send back new domains or IP addresses for interactive command traffic. Not every victim got follow-on actions.[2]

Timeline

  1. February 2020

    Earliest use MITRE gives

    MITRE says APT29 used SUNBURST since at least February 2020.[1]

  2. March 2020

    Compromises begin

    CISA says compromises of US agencies, critical infrastructure and private organizations began at least as early as March 2020.[2]

  3. December 2020

    Compromise discovered

    The UK government says a compromise of SolarWinds was discovered in December 2020.[9]

  4. December 13, 2020

    CISA Emergency Directive 21-01

    CISA ordered federal civilian agencies to disconnect or power down affected Orion versions.[4]

  5. December 16, 2020

    FBI, CISA and ODNI statement

    The three agencies formed a Cyber Unified Coordination Group to coordinate the government response.[5]

  6. 5 January 2021

    Joint statement adds NSA

    The Unified Coordination Group said an APT actor, likely Russian in origin, was responsible for most or all of the compromises, and called it an intelligence gathering effort.[6]

  7. 5 February 2021

    CISA malware analysis report

    CISA published malware analysis report AR21-039A on SUNBURST.[3]

  8. April 15, 2021

    US and UK attribution

    CISA updated its advisory to say the US Government attributes the activity to Russia's SVR. Treasury said the SVR is responsible for the 2020 SolarWinds Orion exploit, and the UK NCSC assessed it as highly likely.[7, 8, 2]

Detection and defense

  1. Use CISA's detection resources

    Read malware analysis report AR21-039A (SUNBURST), which carries detection rules and an indicator file, and advisory AA20-352A, which links a STIX indicator list.[3, 2]

    Counters: T1071.004 T1568

  2. Disconnect affected Orion

    Emergency Directive 21-01 and AA20-352A say to disconnect or power down affected Orion versions, and to block traffic to and from hosts where Orion was installed. The technique pairing is ours.[4, 2]

    Counters: T1071.001 T1071.004

  3. Cut internet access for Orion hosts

    For networks that CISA places in its lower-risk category, AA20-352A says to deny all traffic outside the device management enclave and block public internet traffic to and from Orion hosts.[2]

    Counters: T1071.001 T1071.004

  4. Rebuild and change credentials

    Treat hosts monitored by Orion as compromised, rebuild them from trusted sources, and change every credential used by or stored in SolarWinds software.[4, 2]

  5. Use MFA and strong service accounts

    Enable multi-factor authentication where possible. Where it is not possible, use long random passwords of more than 25 characters with a 90-day rotation.[2]

  6. Keep logs for 180 days

    CISA says to capture and store host, Orion and network logs for at least 180 days in a separate central system. Pairing this with file deletion is ours.[2]

    Counters: T1070.004

  7. Check network devices Orion managed

    Audit device configurations, change device credentials and validate firmware against known good hashes.[2]

  8. Hunt in cloud identity logs

    CISA created the Sparrow tool to help detect possible compromised accounts and applications in Azure and M365 environments.[2, 6]

Questions

What is SUNBURST?

MITRE ATT&CK calls it a trojanized DLL designed to fit within the SolarWinds Orion software update framework. CISA's analysis report describes it as an obfuscated backdoor.

Who is behind SUNBURST?

The US Government, in a CISA advisory update and a Treasury statement of 15 April 2021, attributes the SolarWinds compromise to Russia's Foreign Intelligence Service (SVR), also known as APT29. The UK NCSC assesses it as highly likely. MITRE lists APT29 as a user of SUNBURST.

How did SUNBURST get onto networks?

CISA says a malicious Orion DLL was added into the SolarWinds software lifecycle and signed with the real SolarWinds certificate, then delivered through updates. CISA also found other access routes that did not use Orion.

How many organizations were affected?

The US Unified Coordination Group said in January 2021 that about 18,000 public and private sector customers were affected, and fewer than ten US government agencies had follow-on compromise. The UK government also cites 18,000.

How can I check for it?

Use the detection rules and indicator file in CISA report AR21-039A and the indicator list linked from advisory AA20-352A. Check whether affected Orion versions 2019.4 through 2020.2.1 HF1 were installed.

In our research

  1. Understanding Supply Chain Attack Tactics with Case Study October 2025
  2. APT29 (Cozy Bear): Russia’s Stealth Espionage Powerhouse September 2025
  3. APT29 Threat group

Sources

  1. SUNBURST, Software S0559 MITRE ATT&CKSupports: Description, alias Solorigate, platform, techniques and APT29 link.
  2. Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations, AA20-352A CISASupports: Supply chain compromise, order of events, mitigations, detection tools, SVR attribution update.
  3. MAR-10318845-1.v1 - SUNBURST, AR21-039A CISASupports: Malware analysis, backdoor functions, detection rules and indicators.
  4. ED 21-01: Mitigate SolarWinds Orion Code Compromise CISASupports: Emergency directive, affected versions, required actions.
  5. Joint Statement by the FBI, CISA and ODNI, 16 December 2020 CISASupports: Formation of the Cyber Unified Coordination Group.
  6. Joint Statement by the FBI, CISA, ODNI and NSA, 5 January 2021 CISASupports: Likely Russian origin, intelligence gathering, 18,000 customers, Sparrow tool.
  7. Treasury Sanctions Russia with Sweeping New Sanctions Authority US Department of the TreasurySupports: Treasury says the SVR is responsible for the 2020 SolarWinds Orion exploit.
  8. UK and US call out Russia for SolarWinds compromise UK National Cyber Security CentreSupports: NCSC assessment, 15 April 2021.
  9. Russia: UK exposes Russian involvement in SolarWinds cyber compromise UK Foreign, Commonwealth and Development OfficeSupports: Discovery in December 2020, 18,000 organisations, SVR names.
  10. SolarWinds Compromise, Campaign C0024 MITRE ATT&CKSupports: Campaign overview and April 2021 attribution.
  11. APT29, Group G0016 MITRE ATT&CKSupports: APT29 used SUNBURST in the SolarWinds Compromise.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Backdoor

A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more