CISA: SolarWinds Not the Only Initial Attack Vector in Massive Breach

In yet another twist to the recently revealed major cyber espionage campaign waged by apparent Russian nation-state actors, SolarWinds' network management platform was not the only initial infection vector for the sophisticated attacks, according to the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA).

CISA revealed that juicy tidbit today in a cyber activity alert that calls the attacks a "grave risk" to government agencies, critical infrastructure organizations, and the private sector. The SolarWinds Orion network management platform initially was thought to be the main attack vector; the attackers injected malware into the SolarWinds application, so when users installed an update, they were infected with the stealthy code.

"CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated. CISA will update this Alert as new information becomes available," the agency said in the report.

The agency is investigating incidents where victims were compromised in the same campaign but without the malicious Orion code. They also point to security vendor Volexity's report of a think tank that was compromised via an attack that bypassed Duo and other multifactor authentication to reach its Outlook Web App.

"Volexity attributes this intrusion to the same activity as the SolarWinds Orion supply chain compromise, and the TTPs are consistent between the two. This observation indicates that there are other initial access vectors beyond SolarWinds Orion, and there may still be others that are not yet known," CISA said. 

Duo, meanwhile, said the incidents described in the Volexity report "were not due to any vulnerability in Duo's products." The attacker was able to gain privileged access to the OWA integration credentials from "within an existing compromised customer environment, such as an email server," according to Duo.

CISA reiterated the seriousness of the overall attack campaign: "This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks. Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans."

The attack first was exposed earlier this month when FireEye revealed it had detected a breach that also pilfered its red-team tools.

Read more here.