#Isuzu idss update keep restarting software#

The first connection with the C2 serverДЄfter the update and the first communication with the C2 server, some basic information is sent, including the computer username, IP address and OS version in order to determine if the machine is able to be explored, and also to prevent a second infection. With this behavior in place, detecting and relating it with malicious purposes is harder from the security point of view.

#Isuzu idss update keep restarting software#

The problem starts at this point, and criminals, knowing the typical modus operandiВ of antivirus software, are using this approach to disseminate malware in the wild.Д¬riminals were able to modify the software and add a malicious backdoor inside the SolarWinds Orion plugin DLL called вЂњ.dllвЂќ as observed in Figure 1 below.ДЇigure 1: DLL call modified by criminals to introduce the malicious code (backdoor).ДЄs observed, the backdoor waits 12-14 days before sending its first ping to the C2 server, a technique utilized to evade detection on the network layer. As the package was digitally signed by SolarWinds, it is seen as trusted software and deployed in their internal networks, bypassing EDR systems and antivirus by default. The backdoored package was delivered to SolarWinds customers.

This piece of malware was delivered in the form of a Windows DLL file (.dll), implanted on the SolarWinds update package. The SUNBURST supply chain attack uses the following workflow grouped into six main steps, also described by Cynet in its website.