C0024: SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.CitationCrowdStrike StellarParticle January 2022 Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.CitationSolarWinds Advisory Dec 2020CitationSolarWinds Sunburst Sunspot Update January 2021CitationFireEye SUNBURST Backdoor December 2020CitationVolexity SolarWindsCitationCrowdStrike StellarParticle January 2022CitationUnit 42 SolarStorm December 2020CitationMicrosoft Analyzing Solorigate Dec 2020CitationMicrosoft Internal Solorigate Investigation Blog
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.CitationNSA Joint Advisory SVR SolarWinds April 2021CitationUK NSCS Russia SolarWinds April 2021CitationMandiant UNC2452 APT29 April 2022 The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.CitationUSG Joint Statement SolarWinds January 2021
Security context for executives and security teams
The SolarWinds Compromise matters because it shows how a trusted software update and identity access can become the path into many organizations at once. For leaders, the decision value is not only “was SolarWinds present,” but whether the organization can prove which software supply-chain paths, privileged accounts, tokens, APIs, and remote administration channels would reveal follow-on compromise quickly enough to protect operations.
Executive priority
Prioritize this as a supply-chain, identity, and incident-readiness benchmark. The ATT&CK record describes malicious code injected into the SolarWinds Orion build process, followed by activity such as password spraying, token theft, API abuse, spear phishing, and follow-on access. Executives should ask whether vendor software risk, privileged identity monitoring, cloud/API auditability, and cross-environment incident response are funded and evidenced well enough for regulators, boards, and customers after a major supplier-driven incident.
Technical view
MITRE provides no campaign-level detection text, so defenders should validate coverage from the related behaviors and tools. The relationship set ties the campaign to APT29 and to tools/malware including SUNBURST, SUNSPOT, TEARDROP, Raindrop, GoldMax, Sibot, GoldFinder, TrailBlazer, Mimikatz, Cobalt Strike, and AdFind. It also maps use of DCSync, local data collection, internet and remote system discovery, RDP, SMB/admin shares, WinRM, masquerading, WMI, encrypted exfiltration, and scheduled tasks. SOC and IR teams should test whether endpoint, identity, directory services, network, and administrative activity logs can reconstruct these paths across Windows-heavy environments and any related Linux, macOS, ESXi, or network-device telemetry referenced by mapped techniques.
Likely telemetry
- Software inventory and update history for SolarWinds Orion or other high-trust enterprise software where locally applicable
- Endpoint process, module/DLL, service, scheduled task, WMI, and script execution telemetry
- Windows authentication, RDP, SMB/admin share, WinRM, and lateral movement logs
- Active Directory and domain controller replication-related events relevant to DCSync-style abuse
- Identity provider, token, API, and cloud audit logs where accounts and APIs are in scope
Detection direction
- Do not rely on a single SolarWinds indicator; validate the full chain from software update trust to identity abuse, lateral movement, discovery, persistence, and exfiltration.
- Tune detections around abnormal use of legitimate administration channels such as RDP, SMB/admin shares, WinRM, WMI, and scheduled tasks, with allowlists for expected admin activity to reduce false positives.
- Review privileged account and domain controller monitoring for replication-like behavior associated with DCSync, especially where highly privileged rights are broadly assigned.
- Correlate directory enumeration tools such as AdFind, credential access tooling such as Mimikatz, and post-exploitation frameworks such as Cobalt Strike with account context, host role, and remote logon history.
- Validate retention and access to identity/API/token logs; the campaign description specifically includes token theft and API abuse, which may be missed if monitoring is endpoint-only.
Mitigation priorities
- Start with incident-readiness evidence: maintain authoritative software inventory, supplier exposure records, and the ability to identify affected hosts and update timelines quickly.
- Harden identity paths: reduce standing privilege, review domain replication rights, enforce strong authentication where applicable, and monitor token/API use for abnormal access.
- Restrict and monitor remote administration protocols such as RDP, SMB/admin shares, WinRM, WMI, and scheduled task creation to known administrators, management hosts, and approved workflows.
- Improve endpoint and directory telemetry coverage before tuning advanced detections; missing logs will prevent reconstruction of follow-on compromise.
- Segment critical systems and high-value management infrastructure so supplier-origin access or compromised credentials do not automatically provide broad lateral movement.
Additional notes and limits
This ATT&CK object is a campaign, not a single technique. Its value for defensive planning comes from the relationship context: APT29 attribution, named malware/tools, and mapped techniques spanning supply-chain compromise, credential access, discovery, lateral movement, persistence, stealth, collection, and exfiltration. Use it as a scenario for control validation rather than as a standalone detection rule.
Official detection is not provided and the campaign object itself lists no platforms or tactics. Platform and tactic guidance above is derived only from supplied related software and technique records. Local exposure, tool presence, vendor history, and actual detection coverage require environment-specific evidence.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.CitationCrowdStrike StellarParticle January 2022 Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.CitationSolarWinds Advisory Dec 2020CitationSolarWinds Sunburst Sunspot Update January 2021CitationFireEye SUNBURST Backdoor December 2020CitationVolexity SolarWindsCitationCrowdStrike StellarParticle January 2022CitationUnit 42 SolarStorm December 2020CitationMicrosoft Analyzing Solorigate Dec 2020CitationMicrosoft Internal Solorigate Investigation Blog
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.CitationNSA Joint Advisory SVR SolarWinds April 2021CitationUK NSCS Russia SolarWinds April 2021CitationMandiant UNC2452 APT29 April 2022 The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.CitationUSG Joint Statement SolarWinds January 2021
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.