SolarWinds Hack: A Massive Cyber Threat

This presentation explores the 2020 SolarWinds cyberattack, a sophisticated nation-state attack that compromised major U.S. government agencies and private companies. Learn how hackers infiltrated the supply chain,the impact of the breach, and key lessons in cybersecurity defense and risk mitigation

2. What is SolarWind
How did the attack happen
Timeline
Affected
Purpose
Responsible
Resolution
Conclusion
01
02
03
04
05
06
07
08

3. software company based in Tulsa, Oklahoma
providing SaaS solutions for IT infrastructure, supply
management, network administration, and other
benefits.
they have complete access to customer data, logs,
and workflow details.
Orion
this is the company product which is an IT performance monitoring system.
the platform was used by customers worldwide.
has access to IT systems to obtain log and system performance data.

4. Supply Chain Attack
Inserts malicious code into the Orion system.
A supply chain attack works by targeting a third
party with access to an organization's systems
rather than trying to hack the networks directly.
A backdoor was created which could be accessed
by the hackers to impersonate accounts and users
of victim organizations.
The backdoor allowed the hackers to access
system files and hide their tracks by blending into
the Orion activity, masking the malicious code from
antivirus packages.

5. SEPT
2019
Threat actors gain
unauthorized access
to SolarWinds network
OCT
2019
FEB
2020
MAR
2020
Threat actors test
initial code injection
into Orion
Malicious code known
as Sunburst injected
into Orion
SolarWinds
unknowingly starts
sending out Orion
software updates
with hacked code
More than 18,000 SolarWinds customers installed the
malicious updates, with the malware spreading undetected.

6. FireEye
Microsoft
Intel
Cisco
Deloitte
Homeland
Security
State
Commerce
Treasury
Analysis suggests that by
managing the intrusion through
multiple servers based and
mimicking legitimate network
traffic, the attackers were able to
circumvent threat detection
techniques.

7. The purpose of the hack remains
largely unknown. Still, there are
many reasons hackers would
want to get into an organization's
system, including having access
to future product plans or
employee and customer
information held for ransom.

8. Federal investigators and cybersecurity
agents believe that most likely the
Russia's Foreign Intelligence Service
The Russian Government denied any
involvement
Chinese hackers might be behind the
cybersecurity attack, but has no
evidence to prove.

9. The SolarWinds development
released quick hotfixes to
eliminate the backdoor trojan
and was eventually followed by
a queue of organizations.
Global IT giant Microsoft was
also said to find traces of said
malware in its customer
systems, causing a global
release of security patches.

10. Security practices are very important to
protect the data of the users who are using
the system.
Cybersecurity is an integral part of the system
and plays an important role in securing the
system and detect the risks of attacks.

11. https://www.techtarget.com/whatis/feature/SolarWinds-hack-explained-Everything-you-
need-to-know
https://www.simplilearn.com/tutorials/cryptography-tutorial/all-about-- solarwinds-attack