Threat Signal Report

Latest CISA Malware Analysis Report for SolarWinds Activity (SUPERNOVA)

Description

FortiGuard Labs is aware of a new Malware Analysis Report (MAR 10319053-1.v1) released today by the Cybersecurity and Infrastructure Security Agency (CISA) related to the SUPERNOVA malware family used in the December SolarWinds attack. It is important to note that SUPERNOVA, a webshell backdoor, was not used as part of the supply chain attack on SolarWinds. It was surreptitiously installed by the threat actor via unauthorized access to the victims SolarWinds server, masquerading as a legitimate file. The threat actor utilized a PowerShell script that decoded and installed SUPERNOVA. Ultimately, SUPERNOVA allows a remote attacker to perform the injection of C# code into the SolarWinds web portal on the victim machine. Once this is complete, the source is compiled and executed in memory.


For further details on SolarWinds, please refer to our Threat Signal posting from December.


What are the Technical Details of the Report?

The report provides technical descriptions of three malicious files used in this attack. According to details within the report, the first file is an event log that details the execution of a PowerShell script which is designed to Base64 decode and install a 32-bit.NET DLL file into a specific location. The DLL is then patched with the SUPERNOVA webshell and ultimately replaces the legitimate SolarWinds DLL for further evasion.


The second file is the SUPERNOVA malware. It is a 32-bit .NET DLL file that is a modified SolarWinds plug-in. The modification includes the "DynamicRun" export function which is designed to accept and parse arguments. The arguments are expected to partially contain C# code, which the function will compile and execute directly in system memory.


According to CISA, the purpose of this malware indicates that the attacker has identified a vulnerability which allows the attacker to provide custom arguments via HttpContext to a specific SolarWinds web application function. This is where the remote attacker is able to perform injection of C# code into the SolarWinds web portal on the victim machine, which allows for the source to be compiled and executed in memory.


The third file is a data file and contains artifacts which are likely referenced by the malware..


Is This Limited to Targeted Attacks?

No.


How Serious of an Issue is This?

High.


What is the Status of Protections for this Event?

FortiGuard Labs has AV coverage in place for publicly available samples as:


W32/Sunburst.A!tr


For FortiEDR protections, all publicly available IOC's were added to our Cloud intelligence and will be blocked if executed on customer systems.


Any Other Suggested Mitigation?

Due to the ease of disruption and due to the disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.


It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine the risk to the organization.


Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.