# Russian SVR compromises SolarWinds supply chain targeting US government

Published: 2025-07-14 · Severity: elevated · Sectors: government-national, infrastructure, defense, energy, financial-services, healthcare, technology, telecommunications
Canonical: https://vorant.io/reports/14cf1d47-5827-5573-a713-e12eddea0845/russian-svr-compromises-solarwinds-supply-chain-targeting-us-government

> Russian Foreign Intelligence Service (SVR) compromised SolarWinds Orion software supply chain beginning March 2020, affecting US government agencies, critical infrastructure, and private sector organizations.

The Cybersecurity and Infrastructure Security Agency (CISA) disclosed a sophisticated supply chain compromise of SolarWinds Orion platform affecting US government agencies, critical infrastructure entities, and private sector organizations, with activity beginning at least as early as March 2020. The Russian Foreign Intelligence Service (SVR) injected a malicious Dynamic Link Library (DLL)—solarwinds.orion.core.businesslayer.dll—into the SolarWinds software build, which was then signed with the legitimate SolarWinds code signing certificate. The affected versions of SolarWinds Orion Platform include 2019.4 HF5, 2020.2 RC1, 2020.2 RC2, 2020.2, and 2020.2 HF1.

The malware initially beacons to avsvmcloud[.]com using DNS to receive additional command and control (C2) domains or IP addresses. The adversary demonstrated sophisticated operational security through extensive use of obfuscation, steganography for C2 communications, virtual private servers often located in the victim's home country, and frequent rotation of "last mile" IP addresses. The attacker exploited the privileged access granted to SolarWinds Orion to move laterally within victim environments. Beyond the SolarWinds vector, CISA identified additional initial access methods including password guessing, password spraying, insecure administrative credentials, and abuse of SAML tokens by stealing Duo MFA secret keys to forge authentication cookies. The threat actor established persistence through Azure/Microsoft 365 service principal credentials, federation trust manipulation, and compromised SAML signing certificates to create forged authentication tokens for data exfiltration from email and cloud services.

CISA categorized affected networks into three response categories: Category 1 (no malicious binary present), Category 2 (binary present but limited or no secondary activity), and Category 3 (evidence of follow-on adversary activity requiring immediate incident response and comprehensive reconstitution). The agency emphasized that this threat actor is highly capable, patient, well-resourced, and removal from compromised environments will be complex and challenging.

## Mentioned in this report

- Vulnerabilities: CVE-2020-14687
- Threat actors: Russian Foreign Intelligence Service
- Malware: SUNBURST, Sunshuttle, TEARDROP

## Detection guidance (public sample)

### SolarWinds Orion BusinessLayerHost Spawning Shell or LOLBin Child Process

ATT&CK: T1195.002

SolarWinds.BusinessLayerHost.exe, which loads the trojanized businesslayer DLL, spawning command interpreters or proxy-execution binaries as seen in post-compromise activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SolarWinds Orion BusinessLayerHost Spawning Shell or LOLBin Child Process
id: 214e7d61-95c5-5551-b4c4-a155d0371f50
status: experimental
description: Detects the SolarWinds Orion business layer host process (which loads
  the trojanized solarwinds.orion.core.businesslayer.dll in the SUNBURST supply chain
  compromise) spawning shells, script hosts or living-off-the-land binaries. Generalises
  on the parent/child relation rather than specific payload names.
tags:
- attack.execution
- attack.t1195.002
- attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \SolarWinds.BusinessLayerHost.exe
    - \SolarWinds.BusinessLayerHostx64.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \wmic.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \sc.exe
  condition: selection
falsepositives:
- Orion alert actions or custom scripts configured to execute PowerShell or cmd on
  the Orion server
- Administrator-defined SolarWinds custom monitors that launch scripts
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
```

### Azure AD Service Principal Credential Added or Federation Settings Changed

ATT&CK: T1078

Azure AD audit events for new service principal credentials or federation trust changes, matching the persistence methods in the SVR campaign (forged SAML tokens, service principal abuse). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Azure AD Service Principal Credential Added or Federation Settings Changed
id: 43d675db-d0e8-5b07-800b-277fac1d8de5
status: experimental
description: Detects addition of credentials to service principals and changes to
  domain federation or authentication settings in Azure AD audit logs. These are persistence
  and token-forgery paths used in the SolarWinds-related intrusions; review whether
  the change was an expected administrative action. Best used on a tuned scope of
  privileged actors.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1078
- attack.t1484.002
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
    - Add service principal credentials
    - Set federation settings on domain
    - Set domain authentication
  condition: selection
falsepositives:
- Planned application onboarding or secret rotation performed by identity administrators
- Legitimate federation configuration changes during an ADFS or SSO migration
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/14cf1d47-5827-5573-a713-e12eddea0845/russian-svr-compromises-solarwinds-supply-chain-targeting-us-government.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup