Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise

Russian SVR APT Actor Activity

The SVR actors added malicious code to certain versions of the SolarWinds Orion platform and leveraged it for initial access to select enterprise networks. Through incident response, CISA determined that, in other instances, the SVR actors obtained initial access by password guessing, password spraying, and exploiting inappropriately secured administrative credentials via remote services.

In some instances, once inside the network, the SVR actors bypassed multi-factor authentication (MFA) and moved laterally to Microsoft cloud systems by compromising federated identity solutions. SVR actors:

• Stole the Active Directory Federation Service (ADFS) token-signing certificate to forge Security Assertion Markup Language (SAML) tokens. This technique—referred to as “Golden SAML”—enabled SVR actors to bypass the federated resource provider's MFA and password requirements and thereby move laterally to M365 environments.
• Modified or added trusted domains in Azure AD. This technique enabled SVR actors to add new federated identity providers (iDPs) and thereby move laterally to Azure AD environments. (See FireEye White Paper: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452.)

After gaining access to cloud environments, the SVR actors established persistence mechanisms for Application Programming Interface (API)-based access and collected and exfiltrated data.

The SVR actors have demonstrated sophisticated defense evasion skills. They:

• Hid their command and control (C2) communications with extensive obfuscation,
• Hid their activity among legitimate user traffic, and
• Established difficult-to-detect persistence mechanisms (e.g., in API).

Note: for more information on this activity, including tactics, techniques, and procedures (TTPs), refer to CISA Alerts and joint publications:

• Joint NCSC-CISA-FBI-NSA CSA: Further TTPs associated with SVR cyber actors
• AA21-116A Joint FBI-DHS-CISA Cybersecurity Advisory: SVR Cyber Operations: Trends and Best Practices for Network Defenders
• Joint NSA-CISA-FBI Cybersecurity Advisory: Russian SVR Targets U.S. and Allied Networks
• AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
• AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations

Risk/Impact Assessment

Organizations that used affected versions of SolarWinds Orion should conduct a risk assessment, if they have not already done so, to determine if their network was compromised, and if applicable, the severity of compromise. As defined in CISA Activity Alert AA20-352A:Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations, networks with SolarWinds Orion products will fall into one of three categories.

• Category 1 includes agency networks that do not have the identified malicious binary code on their network and can forensically confirm that the binary was never present on their systems. This includes networks that do not, and never did, use the affected versions of SolarWinds Orion products.
• Category 2 includes agency networks where the presence of the malicious binary has been identified—with or without beaconing to avsvmcloud[.]com.
• Category 3 includes agency networks that used affected versions of SolarWinds Orion and have evidence of follow-on threat actor activity, such as binary beaconing to avsvmcloud[.]com and secondary C2 activity to a separate domain or IP address (typically but not exclusively returned in avsvmcloud[.]com Canonical Name record [CNAME] responses).

Note: As described above, CISA is aware of other initial access vectors. Organizations should not assume they are not compromised by this actor solely because they have never used affected versions of SolarWinds Orion. Those organizations should investigate to confirm they have not observed related threat actor TTPs.

Resources

• CISA Activity Alert AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations
• CISA Emergency Directive (ED) 21-01: Mitigate SolarWinds Orion Code Compromise

Remediating Malicious Activity: Category 1 and 2 Organizations

Although unaffected by this incident, Category 1 organizations should work to maintain strong network posture and resilience. Refer to https://www.cisa.gov/cybersecurity for assistance. CISA recommends Category 1 organizations:

• Maintain up-to-date antivirus signatures and engines. See Protecting Against Malicious Code.
• Ensure systems have the latest security updates. See Understanding Patches and Software Updates.
• Enforce a strong password policy. See Choosing and Protecting Passwords.
• Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
• Sign up to receive CISA’s alerts on security topics and threats.
• Sign up for CISA’s free vulnerability scanning and testing services to help organizations secure internet-facing systems from weak configuration and known vulnerabilities.
• Email vulnerability@cisa.dhs.gov to sign up. See https://www.cisa.gov/cyber-resource-hub for more information about vulnerability scanning and other CISA cybersecurity assessment services.

Category 2 organizations should continue enhanced monitoring for any possible follow-on adversary activity. Refer to resources below for more information.

Resources:

• CISA Activity Alert AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations
• CISA Activity Alert AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
• CISA Emergency Directive (ED) 21-01: Mitigate SolarWinds Orion Code Compromise

According to ED 21-01 and associated supplemental guidance, all federal agencies that ran affected versions of SolarWinds Orion must “conduct system memory, host storage, network, and cloud forensic analysis,” “hunt for indicators of compromise (IOCs) or other evidence of threat actor activity, such as secondary actions on objectives (AOO),” and “[i]dentify and remove all threat actor-controlled accounts and identified persistence mechanisms.”

Remediating Malicious Activity: Category 3 Organizations

Remediation plans for dealing with malicious compromises are necessarily unique to every organization, and success requires careful consideration. To assist affected organizations in crafting eviction plans, CISA has released AR21-134A: Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise, which provides in-depth steps and resources for eviction. The guidance has three phases:

• Phase 1: Pre-Eviction. Actions to detect and identify APT activity and prepare the network for eviction.
• Phase 2: Eviction. Actions to remove the APT actor from on-premises and cloud environments. This phase includes rebuilding devices and systems.
• Phase 3: Post-Eviction. Actions to ensure eviction was successful and the network has good cyber posture.

In accordance with ED-21-01: Supplemental Direction Version 4, agencies which had or have affected versions of SolarWinds Orion and have evidence of follow-on threat actor activity must execute and complete applicable eviction steps by July 16, 2021. Completing all the steps provided in the eviction guidance is necessary to fully accomplish eviction.

The eviction will be resource-intensive and highly complex, requiring the enterprise network to be disconnected from the internet for 3–5 days; however, failure to perform a comprehensive and thorough remediation will expose enterprise networks and cloud environments to substantial risk of long-term undetected APT activity, including email monitoring, data collection, and exfiltration. CISA recommends organization leadership read the CISA Insights, Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise: Risk Decisions for Leaders, for more information.

Resources: CISA, Federal Government, and International Partner Publications

Note: the following publications focus on the SolarWinds Orion Compromise and Related Activity

Table 1: CISA, Federal Government, SLTT, and International Partners Publications

Table 2: Industry Publications

Note: The information you have accessed or received is being provided “as is” for informational purposes only. DHS and CISA do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by DHS or CISA.