OpenTrojan Intelligence Infrastructure
Search intelligence, CVEs, threats… Search
Ask AI Analyst API
English中文Español日本語Deutsch
Enter Portal

SUNBURST

malware OpenTrojan Threat Intelligence

Trojanized SolarWinds Orion DLL used in the 2020 supply-chain compromise; delivered a backdoor with DNS and HTTP C2, sleep-based evasion and dynamic resolution.

Source Attribution

Origin
MITRE
Source
MITRE ATT&CK · CISA · Microsoft · FireEye
Verified
2026-09-07
Confidence
high

Source: MITRE ATT&CK · CISA · Microsoft · FireEye · Verified: 2026-09-07 · Confidence: high

Security Timeline

  • discovered SUNBURST used by APT29 since at least February 2020 (MITRE)
  • exploited FireEye discloses the trojanized Orion builds; CISA issues emergency directive 21-01
  • updated Entity profile expanded (Stage F Batch 3) with MITRE S0559 technique data

Quick Answer

SUNBURST is the trojanized SolarWinds Orion DLL (S0559, also called Solorigate) used by APT29 from at least February 2020: it evaded detection with sleep-based throttling, used DNS and HTTP for C2, dynamically resolved infrastructure, and delivered follow-on payloads such as TEARDROP.

Definition

SUNBURST (MITRE S0559) is a trojanized DLL designed to fit within the SolarWinds Orion update framework. It was used by APT29 since at least February 2020 and communicated via DNS and HTTP C2 while throttling execution to evade sandbox and behavioral detection.

Overview

SUNBURST (MITRE S0559, also known as Solorigate) is a trojanized DLL that was designed to fit inside the SolarWinds Orion software update framework. It was used by APT29 since at least February 2020 and delivered to over 18,000 organizations through signed software updates during the SolarWinds SUNBURST supply-chain attack.

Aliases

Solorigate.

First known / relevant context

First observed in the wild from at least February 2020; publicly disclosed in December 2020 when FireEye reported the compromise of the Orion build pipeline and CISA issued Emergency Directive 21-01.

Targets

  • Windows platforms
  • SolarWinds Orion customers (government, technology and security companies among observed follow-on victims)

Platforms

Windows.

Capabilities

  • Backdoor C2 — communicated via HTTP GET/POST to third-party servers and via DNS designed to mimic normal SolarWinds API communications (T1071.001, T1071.004).
  • Stealth — remained dormant after initial access for up to two weeks (sleep-based evasion), added junk bytes to C2 traffic, and made C2 data appear as benign XML/JSON (T1001.001).
  • Dynamic infrastructure — dynamically resolved C2 infrastructure using randomly generated subdomains within a parent domain (T1568.002).
  • Encryption — encrypted C2 traffic with a single-byte XOR cipher (T1573.001) and used Base64 encoding in C2 traffic (T1132.001).
  • Anti-analysis — checked domain name and processes/services against a hardcoded blocklist before execution, and attempted to disable security services (T1518.001).
  • Payload delivery — delivered follow-on payloads including TEARDROP in at least one instance (T1105), and used IFEO Debugger registry values to trigger installation of Cobalt Strike.
  • Cleanup — removed registry values related to HTTP proxy and IFEO persistence to clean traces (T1070).

Techniques

IDNameObservation (source)
T1071.001Web ProtocolsHTTP GET/POST C2 to third-party servers (MITRE/FireEye)
T1071.004DNSDNS C2 mimicking Orion API communications (MITRE/FireEye)
T1059.005Visual BasicVBScripts used to initiate payload execution (MITRE/Microsoft)
T1132.001Standard EncodingBase64 encoding in C2 traffic (MITRE/FireEye)
T1001.001Junk DataJunk bytes added to C2 over HTTP (MITRE/FireEye)
T1568.002Domain GenerationDynamic resolution of C2 via random subdomains (MITRE/FireEye)
T1573.001Symmetric CryptographySingle-byte XOR cipher for C2 (MITRE/FireEye)
T1027Obfuscated Files or InformationFNV-1a + XOR obfuscation of collected system info (MITRE/FireEye)
T1105Ingress Tool TransferDelivered TEARDROP and other payloads (MITRE/FireEye)
  • APT29 (MITRE G0016) — MITRE and Microsoft attribute SUNBURST use to APT29; attribution is analytic and based on published research, not absolute.

IOCs

IOC claims must come from reliable sources; the following are published, well-known indicators from the initial FireEye/Microsoft disclosures. Treat them as historical — not a complete or current blocklist.

  • C2 domain family avsvmcloud.com (FireEye disclosure, December 2020)
  • The trojanized SolarWinds.Orion.Core.BusinessLayer.dll — verify file hashes against vendor research rather than relying on memory
  • Additional IOCs for your environment: not available here — derive them from trusted vendor research (CISA AA20-352a, FireEye/Mandiant) rather than unverified lists.

Detection

  • Review SolarWinds Orion build/update artifacts for the trojanized DLL and its version.
  • Monitor DNS for C2-style patterns and dynamic subdomain resolution tied to Orion hosts.
  • Look for the sleep-based throttling and delayed post-compromise activity in endpoint telemetry.
  • Correlate with the SolarWinds campaign page and CISA guidance for hunt steps.

Mitigation

  • Remove the trojanized Orion update and re-image affected hosts where suspected.
  • Revoke credentials and tokens that may have been exposed to the Orion compromise path.
  • Apply CISA Emergency Directive 21-01 guidance and vendor recovery recommendations.
  • Validate software supply chain integrity going forward (signed builds, isolated pipelines).

Related content

  • Hash Checker — verify file hashes against known data.
  • IOC Lookup — check indicators against intelligence.
  • DNS Lookup — inspect C2-domain resolution patterns.

Investigation path

  1. Confirm the artifact (DLL hash, signed build) → 2. Check indicators via IOC Lookup → 3. Inspect DNS/C2 patterns → 4. Map to techniques and the campaign → 5. Record evidence and mitigation in an investigation.

Start a new investigation to track findings, evidence and remediation.

Malware Intelligence

Family: SUNBURST

Aliases: Solorigate

Techniques: T1071.001, T1071.004, T1059.005, T1132.001, T1001.001, T1568.002, T1573.001, T1027, T1105

Targets: Windows, SolarWinds Orion customers

Behavior:
  • Trojanized signed Orion DLL delivered through a compromised build pipeline
  • Sleep-based throttling (dormant up to two weeks) to evade sandboxes
  • DNS and HTTP(S) C2 designed to blend with normal SolarWinds API traffic
  • Dynamically resolves C2 infrastructure via randomly generated subdomains
  • Disables security services after checking a hardcoded process/service blocklist
  • Delivers follow-on payloads such as TEARDROP

Related

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating SUNBURST. The workspace is a structured analysis surface — not a chat — organised as:

  1. Question — what do you need to know about SUNBURST?
  2. Evidence — assertions mapped to verifiable references.
  3. Timeline — events in chronological order.
  4. Related Entities — CVE, threat actor, campaign, malware links.
  5. Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
  6. Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace

Recommended Tools

Every tool runs passively or locally — inputs are never stored and no target is scanned. Start an investigation on this entity →