Thread by @SpicyNoodles2

Interesting thread about the #SolarWindsHack #Sunburst 👇

https://twitter.com/johnwetzel/status/1344313230194335747

I've said from day one that the injection of the non-malicious code back in 2019 was a dry run to see if the dll would build and not throw any red flags. What I didn't know is that the dll was also inflated in size to allow for additional code to be inserted at a later date.

The immediate attribution to RU especially APT29 was always questionable IMHO. Especially when you see the same exact players in the media parroting it from the rooftops in record time...

Here is a link to the summary:

recordedfuture.com/solarwinds-att…

Here is the full report:

go.recordedfuture.com/hubfs/reports/…