The breach began no later than March 2020 after attackers penetrated SolarWinds’ software-publishing environment and inserted the SUNBURST backdoor into Orion updates released between March and June 2020. SolarWinds said roughly 18,000 of the 33,000 Orion customers downloaded compromised versions, although downloading the software alone did not prove that a victim was breached. The malware remained dormant for 12–14 days, then contacted attacker-controlled servers while mimicking legitimate SolarWinds traffic. It ultimately enabled intruders to reach sensitive systems at the U.S. Treasury and Commerce departments, including Treasury email used by senior officials, and affected or potentially affected organizations such as NATO, the European Parliament and parts of the U.K. government.
The incident also exposed weaknesses beyond SolarWinds. Attackers exploited Microsoft authentication and cloud infrastructure, including forged identity tokens and the Zerologon vulnerability, while VMware Access flaws provided another possible route for persistence. SolarWinds had previously been warned in November 2019 that its FTP server allowed malicious uploads, and the company had experienced other security shortcomings. FireEye discovered the campaign while investigating its own December 2020 breach and reported it to the NSA. On January 5, 2021, CISA, the FBI, NSA and intelligence officials said Russia was the most likely culprit; FBI Director Christopher Wray specifically attributed it to Russia’s SVR on June 10, 2021. Russia denied involvement, while former CEO Kevin Thompson retired on December 7, 2020 and private-equity shareholders sold substantial stock that day, transactions they denied were insider trading.
