Information Security
Case Study Report
SolarWinds Supply Chain Attack (2020)
Prepared by:
Shehzad
April 2026
1. Introduction
Information Security is essential for protecting digital infrastructure against sophisticated
cyber threats. This report examines the SolarWinds Supply Chain Attack, one of the
most complex and far-reaching cyber espionage campaigns ever discovered. Disclosed
in December 2020, the attack compromised thousands of organizations worldwide,
including major US government agencies and Fortune 500 companies. This case study
analyzes the attack methodology, motives, vulnerabilities, tools used, data
compromised, and the recovery process.
2. Company Background
SolarWinds is an American IT management software company based in Austin, Texas.
Its flagship product, Orion, is a widely used network monitoring and management
platform. Orion was deployed by approximately 33,000 customers, including numerous
US federal government agencies such as the Department of Homeland Security, the
Treasury Department, the Department of Commerce, and major private sector
companies like Microsoft and FireEye.
3. Overview of the Breach
The SolarWinds attack was a sophisticated supply chain compromise. Attackers
infiltrated SolarWinds’ software build system and inserted malicious code (dubbed
SUNBURST) into the Orion software updates distributed between March and June
2020. Approximately 18,000 organizations installed the compromised update. The
attackers then selectively targeted a smaller subset of high-value organizations for
deeper infiltration and data exfiltration. The breach was discovered by cybersecurity firm
FireEye in December 2020.
4. Motive Behind the Attack
The primary motive was cyber espionage on behalf of a nation-state. The attack was
attributed to APT29 (also known as Cozy Bear), a hacking group linked to the Russian
Foreign Intelligence Service (SVR). The attackers aimed to gain long-term access to
sensitive government communications, policy documents, intelligence data, and
corporate secrets. Unlike financially motivated attacks, this campaign prioritized stealth
and sustained access over immediate monetary gain.
5. How the Attack Was Executed
The attackers first gained access to SolarWinds’ internal development environment,
possibly through compromised credentials or a vulnerable internal server. They injected
the SUNBURST backdoor into the Orion software’s source code during the build
process. This ensured the malicious code was digitally signed with SolarWinds’
legitimate certificate, making it appear trustworthy. Once installed by customers,
SUNBURST lay dormant for about two weeks before communicating with command-
and-control servers disguised as legitimate Orion traffic. The attackers then used
additional tools like TEARDROP and Cobalt Strike to escalate privileges, move laterally,
and exfiltrate data from selected targets.
6. Security Loopholes Identified
• Weak security in SolarWinds’ software build and development pipeline.
• Inadequate code integrity verification during the build process.
• Over-reliance on trusted software vendors without verifying update integrity.
• Insufficient network monitoring to detect unusual outbound traffic patterns.
• Weak password policies (reportedly, the SolarWinds update server password
was “solarwinds123”).
7. Tools and Techniques Used by Attackers
The attackers employed a range of custom and publicly available tools. The primary
backdoor was SUNBURST, which was embedded directly into the Orion software DLL.
TEARDROP was a memory-only malware dropper used to deploy Cobalt Strike
beacons for lateral movement. The attackers also used SUNSPOT, a tool designed to
monitor the SolarWinds build process and inject malicious code at the right moment.
Domain fronting and encrypted channels were used to disguise command-and-control
communications as normal network traffic.
8. Information Stolen
• Internal emails and documents from US government agencies
• Source code from technology companies (including portions of Microsoft’s source
code)
• Security tools and red team assessment methodologies from FireEye
• Network configurations and security architecture details
• Sensitive policy and intelligence communications
9. Post-Breach Activity
The attack was primarily focused on intelligence gathering rather than disruption or
financial gain. No ransom demands were made. The stolen FireEye red team tools
raised concerns about potential future attacks using those tools. The US government
declared the breach a significant national security event. Investigation revealed that the
attackers maintained access to some compromised networks for over nine months
before discovery.
10. Company Recovery and Response
SolarWinds immediately released hotfix updates to remove the SUNBURST backdoor
and worked with the Cybersecurity and Infrastructure Security Agency (CISA) and other
agencies to coordinate the response. The company rebuilt its build environment from
scratch with enhanced security measures. FireEye publicly disclosed the breach and
released detection tools for the stolen red team utilities. The US government imposed
sanctions on Russia and expelled diplomats in response. Affected organizations
conducted extensive forensic investigations, rotated credentials, and rebuilt
compromised systems. SolarWinds invested heavily in its “Secure by Design” initiative
to overhaul its security practices.
11. Impact of the Breach
The SolarWinds attack had widespread consequences. It compromised critical US
government agencies and major corporations, exposed national security vulnerabilities,
and shook trust in the software supply chain globally. SolarWinds suffered significant
reputational and financial damage, with its stock price dropping sharply after the
disclosure. The incident led to executive-level policy changes in the US government
regarding cybersecurity, including an Executive Order on Improving the Nation’s
Cybersecurity issued in May 2021.
12. Lessons Learned
1. Supply chain security must be a top priority; organizations should verify the
integrity of all third-party software.
2. Zero-trust architecture should be adopted to minimize the impact of any single
point of compromise.
3. Continuous monitoring of network traffic for anomalous behavior is essential.
4. Software build pipelines must be secured with code signing verification and
integrity checks.
5. Incident response plans should include supply chain compromise scenarios and
rapid coordination with government agencies.