Supply chain · December 13, 2020 · 7 min
SolarWinds: Russia poisoned the software 18,000 organizations already trusted
MedellínSoftware · Medellín, Colombia
APT29, the SVR. An Orion update with a door inside it. Treasury, Commerce, FireEye, Microsoft. Months of silence. The supply chain as a state weapon.
medellinsoftware.com/story/solarwinds-apt29-rusia-18000-organizaciones/
Customers
~18,000
Group
APT29 · Cozy Bear
Malware
SUNBURST
Found
Dec 2020
Nobody hacked 18,000 doors. They hacked the locksmith. SolarWinds signed and shipped Orion with SUNBURST inside. Customers installed the update as they always did. Russia's SVR — APT29, Cozy Bear — sat down and chose who was worth the time.
FireEye found it because its own red-team tools were stolen. Then U.S. agencies, Microsoft, think tanks. It was not noise. It was the patience of an intelligence service.
The build, the command servers, and who was actually compromised — few, the ones who mattered — show why your monitoring vendor can be the worst place to hide.
The desk
The file is public. The briefing is requested.
AI and deep military intelligence. Medellín.