Supply Chain

SolarWinds — The Supply Chain Attack That Broke Fortune 500

What Happened

In December 2020, FireEye disclosed that nation-state actors (attributed to Russian SVR/Cozy Bear) had breached SolarWinds' CI/CD system and injected malicious code — named SUNBURST — into official Orion software updates. For 14 months, 18,000 customers downloaded and ran the backdoor as signed, trusted code. Only about 100 organizations were selected for further exploitation — including U.S. government agencies and Fortune 500 companies.

Root Cause

Compromised CI/CD pipeline. Attackers gained access to SolarWinds' build environment, injected SUNBURST as a step in the MSBuild compilation process, and then digitally signed the resulting DLL. SUNBURST slept for 12–14 days after installation, then periodically communicated with C2 servers masquerading as Orion Improvement Program traffic. The final target selection was manual — the attackers analyzed each infected organization and decided whether to go deeper.

Who Was Affected

  • U.S. Treasury, Commerce, Energy, Homeland Security
  • FireEye (the company that discovered the attack)
  • Microsoft, Cisco, Intel, NVIDIA
  • Total SolarWinds customers: 18,000+ downloaded the backdoor
  • Cost: Estimated $90 billion total

How It Was Detected

FireEye found it when the theft of their own red-team tools was detected — the attackers had used an MFA token registered to a FireEye employee's name to access the corporate network. Tracing backwards revealed SUNBURST on their Orion server. Mandiant published the detailed analysis on December 13, 2020, revealing the supply chain compromise.

How It Was Fixed

There was no simple patch for affected organizations:

  • Disconnect Orion servers from the internet
  • Full reinstallation of environments
  • Rotation of all API keys, secrets, and certificates
  • SolarWinds released cleaned updates months later
  • Executive Order 14028 issued as a result — mandating SBOM and zero-trust for U.S. federal agencies

    • Lessons for Your SaaS

    • Your CI/CD is your most valuable target. If an attacker breaches your pipeline, every deployment is a backdoor. Protect build environments like production.
    • SBOM is now a legal requirement. If you sell to government agencies or enterprise, you won't pass a security audit without one.
    • Anomaly detection, not just signatures. SUNBURST was signed, legitimate, and delayed by 2 weeks. Only unusual network traffic patterns detected it.
    • Incident response readiness. When you're compromised through a vendor, you can't just patch — you have to rebuild. Have a plan.
    Request a Security Assessment