← Incident Index
CivilizationalIT Infrastructure·December 13, 2020Draft

SolarWinds: SUNBURST malware injected into Orion build pipeline compromises 18,000 organisations

Russian state-affiliated actors compromised SolarWinds's Orion build server and injected malicious code (SUNBURST) into a signed software update, distributing the backdoor to 18,000 customers including US federal agencies.

Velocity Governance perspective· Sentinel-10 overlap: 2 of 4

2 of the 4 practices that failed in this incident are part of the Sentinel-10 — the engineering protocols Concordance flags as most degraded under AI-accelerated development.

This incident pre-dates today's AI-velocity surge. The thesis is that the same practices that failed here will fail faster under AI velocity if not actively governed. Read the Velocity Governance thesis →

Impact

$100.0B
Economic impact
18,000
Affected
SEC enforcement action against SolarWinds + CISO (Oct 2023); US government attribution to Russia
Regulatory action

Estimated >$100B in global remediation cost. Affected US Treasury, Commerce, Homeland Security, State, NIH, parts of the Pentagon. Triggered Executive Order 14028 (Improving the Nation's Cybersecurity).

Root cause (from published RCA)

Threat actor obtained initial access and inserted malicious code into the Orion build pipeline. Modifications to source code occurred during the build process; the resulting binary was signed with a legitimate code-signing certificate and distributed via standard update channels. Pipeline integrity controls did not detect the unauthorised code modification.

Concordance protocols that map to this root cause

Click any protocol to see every other indexed incident where it failed.

Protocol 4.8Build Reproducibility· Testingsee all incidents →
Build reproducibility / pipeline integrity controls did not detect injected code in the compiled artifact.
Protocol 3.5Approval Rigor· Developmentsee all incidents →
Approval rigor on build-pipeline changes was insufficient to prevent unauthorised modification of build steps.
Protocol 3.9Secrets Management· DevelopmentSENTINELsee all incidents →
Code-signing key access was not adequately segmented from build infrastructure that could be compromised.
Protocol 4.6Security Analysis· TestingSENTINELsee all incidents →
Security analysis of build outputs did not include behavioural diffing that would have detected the new outbound network behaviour introduced by SUNBURST.

Primary sources

SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures
US SEC · October 30, 2023
CISA Advisory AA20-352A: Advanced Persistent Threat Compromise of Government Agencies
CISA · December 17, 2020
SolarWinds Security Advisory
SolarWinds · December 13, 2020

Related incidents

Other incidents that failed at least one of the same protocols.

xz utils (Tukaani Project)Mar 2024
CVE-2024-3094 — multi-year social-engineering attack inserts backdoor …
OktaOct 2023
Okta support-portal HAR file leak exposes 134 customer environments
CodecovApr 2021
Codecov bash-uploader supply-chain compromise exfiltrates customer sec…
Progress Software (MOVEit)May 2023
CVE-2023-34362 SQL injection in MOVEit Transfer leads to mass data the…
#supply-chain#build-integrity#code-signing#nation-state#sec-action
Check your repo against these protocols.
Concordance scores any public GitHub repo against all 50 engineering protocols in 60 seconds. No signup, no install.
Run a free scan →
Concordance Incident Index entry · CC BY 4.0 · Methodology · Errata: hello@concordancelabs.com