Researchers find 18 additional command servers used in SolarWinds campaign. Also find that two servers previously known, that were used to push 2nd-stage malware, were mysteriously active Feb 27, 2020, a month before SW customers got infected w/ backdoor zetter.substack.com/p/research-unc…
If servers were pushing out 2nd-stage malware to victims in Feb, this raises the possibility that 1) a previously unknown version of SW software was compromised and infected customers a month before SW says customers got infected...
2) the 2nd stage command servers were pushing out 2nd-stage malware to victims who were already infected w/ something other than the SolarWinds software that carried the backdoor or ...
3) the attackers were doing a test run of the delivery of the 2nd-stage malware, as they had done in Oct. 2019 when they had done a test run of delivering the backdoor to customers thru the SolarWinds software
• • •
Missing some Tweet in this thread? You can try to
force a refresh
