1/ could it be that #SUNBURST introduced #SUPERNOVA, but only to victims of interest (not the whole 18K)?
Abusing #Solarwinds Orion vulns with #SUPERNOVA , attackers can bypass auth and get access to Orion.
From there they get access to cloud cert to Sign #GoldenSAML
Abusing #Solarwinds Orion vulns with #SUPERNOVA , attackers can bypass auth and get access to Orion.
From there they get access to cloud cert to Sign #GoldenSAML
https://twitter.com/USCERT_gov/status/1342921508872617984
2/ If so this explains a lot:
It means no mysterious second actor as originally claimed by Microsoft reducing the complexity of this story
microsoft.com/security/blog/…
It means no mysterious second actor as originally claimed by Microsoft reducing the complexity of this story
microsoft.com/security/blog/…
3/ it explains why the #SUPERNOVA webshell was not signed (because it's not part of the backdoor payload, but introduced later)
And finally, it tightly connects the method of entry to the #GoldenSAML post exploitation.
And finally, it tightly connects the method of entry to the #GoldenSAML post exploitation.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
