Security advisories

SolarWinds Breach

December 14, 2020 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT:

On December 14th, FireEye disclosed a widespread global intrusion campaign. During their investigation, they discovered that an attacker exploited vulnerabilities within the SolarWinds® Orion® Platform. The malware subsequently masqueraded its traffic as Orion Improvement Protocol and blended in with legitimate SolarWinds activity to obfuscate the threat actors’ activities.

SolarWinds has released an initial hotfix to the Orion Platform. It is recommended that customers using SolarWinds disable the vulnerable instance as noted and prepare to upgrade (pending appropriate testing and maintenance windows). A second hotfix with additional mitigations is expected to be released tomorrow (Tuesday, December 15th, 2020).

eSentire has added new detection and protection content for this specific threat based on information and countermeasures disclosed by SolarWinds, CISA and FireEye. We will continue to monitor the situation and deploy new detection and protection content as necessary.

What we're doing about it:

What you should do about it:

Additional Information:

[1] https://www.solarwinds.com/sec...

[2] https://cyber.dhs.gov/ed/21-01...

[3] https://www.fireeye.com/blog/t...

[4] https://isc.sans.edu/forums/di...

View Most Recent Advisories