FireEye SUNBURST Backdoor December 2020

SUNBURST added junk bytes to its C2 over HTTP.

SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.

SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.

SUNBURST collected information from a compromised host.

SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.

TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.

SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.

TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.

SUNBURST obfuscated collected system information using a FNV-1a + XOR algorithm.

SUNBURST collected the username from a compromised host.

TEARDROP files had names that resembled legitimate Window file and directory names.

SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.

During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.

SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.

SUNBURST had a command to delete files.

During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.

SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.

SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.

During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

SUNBURST collected hostname and OS version.

SUNBURST had commands to enumerate files and directories.

SUNBURST delivered different payloads, including TEARDROP in at least one instance.

During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.

SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.

SUNBURST collected device `UPTIME`.

SUNBURST used Base64 encoding in its C2 traffic.

TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.

During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.

SUNBURST remained dormant after initial access for a period of up to two weeks.

TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.

SUNBURST was digitally signed by SolarWinds from March - May 2020.

During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.

SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.

SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.

For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.

During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.