UPDATE: Microsoft continues to work with partners and customers to expand our knowledge of the threat actor behind the nation-state cyberattacks that compromised the supply chain of SolarWinds and impacted multiple other organizations. Microsoft previously used ‘Solorigate’ as the primary designation for the actor, but moving forward, we want to place appropriate focus on the actors behind the sophisticated attacks, rather than one of the examples of malware used by the actors. Microsoft Threat Intelligence Center (MSTIC) has named the actor behind the attack against SolarWinds, the SUNBURST backdoor, TEARDROP malware, and related components as NOBELIUM. As we release new content and analysis, we will use NOBELIUM to refer to the actor and the campaign of attacks.
Microsoft is monitoring a dynamic threat environment surrounding the discovery of a sophisticated attack that included compromised binaries from a legitimate software. These binaries, which are related to the SolarWinds Orion Platform, could be used by attackers to remotely access devices. We have established a resource center that is constantly updated as more information becomes available at https://aka.ms/solorigate.
On Sunday, December 13, Microsoft released detections that alerted customers to the presence of these malicious binaries, with the recommendation to isolate and investigate the devices. It is important to understand that these binaries represent a significant threat to customer environments. Customers should consider any device with the binary as compromised and should already be investigating devices with this alert.
Starting on Wednesday, December 16 at 8:00 AM PST, Microsoft Defender Antivirus will begin blocking the known malicious SolarWinds binaries. This will quarantine the binary even if the process is running. We also realize this is a server product running in customer environments, so it may not be simple to remove the product from service. Nevertheless, Microsoft continues to recommend that customers isolate and investigate these devices:
If service interruption is not possible, customers must take the action below to exclude SolarWinds binaries. This should be a temporary change that you should revert as soon as you update binaries from the provider or complete your investigation.
For Microsoft Defender Antivirus via GPO Instructions:
PATH: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus (or Windows Defender Antivirus) > Threats > Specify threats upon which default action should not be taken when detected.
Value name: 2147771206
Value: 6
For SCEP via GPO instructions:
PATH: Computer Configuration > Administrative Templates > Windows Components > Endpoint Protection > Threats > Specify threats upon which default action should not be taken when detected.
Value name: 2147771206
Value: 6
Note: If you don’t see the “Endpoint Protection” section, see: Manage Endpoint Protection using Group Policies – Configuration Manager | Microsoft Docs
For Microsoft Defender Antivirus and SCEP via SCCM Instructions:
PATH: Assets and Compliance, Endpoint Protection > Antimalware Policies > Threat overrides > Enter Threat name: Trojan:MSIL/Solorigate.BR!dha
PATH: Assets and Compliance, Endpoint Protection > Antimalware Policies > <Select relevant policy> > Threat overrides > Enter Threat name: Trojan:MSIL/Solorigate.BR!dha
Override action: Allow
For MDAV via MEM using PowerShell Instructions:
Set-MpPreference -ThreatIDDefaultAction_Ids 2147771206 -ThreatIDDefaultAction_Actions 6
Name: Allow SolarWinds temporarily
Description: Allow SolarWinds temporarily while patching
Run this script using the logged on credentials: No
Enforce script signature check: No
Run script in 64-bit PowerShell Host: Yes
Note: For MEM (Intune) PowerShell script troubleshooting, review: C:\ProgramData\Microsoft Intune Management Extension\Logs\IntuneManagementExtension.log
For manual Microsoft Defender Antivirus via PowerShell Instructions:
Launch PowerShell as Admin
Set-MpPreference -ThreatIDDefaultAction_Ids 2147771206 -ThreatIDDefaultAction_Actions 6
For manual SCEP via PowerShell Instructions:
Launch PowerShell as Admin
Import-Module “$env:ProgramFiles\Microsoft Security Client\MpProvider\MpProvider.psd1”
Set-MProtPreference -ThreatIDDefaultAction_Ids 2147771206 -ThreatIDDefaultAction_Actions 6
For Automatic remediation exclusions:
Go to Settings > Indicators > File Hashes, and add the specific file hashes for the affected DLLs, select response action as Allow and Save.
Alternate exclusion option by path:
C:\Program Files (x86)\SolarWinds\Orion\
OR
<solar_windows_custom_install_location>\Orion\
Note: If you configure exclusions based on folder location, make sure you remove this exclusion AS SOON AS POSSIBLE after you get remediated binaries from the vendor. Otherwise, you are leaving a place on your devices for future attacks.
Note for Microsoft Defender Antivirus in passive mode:
Microsoft has been communicating with SolarWinds regarding this incident. SolarWinds has released updates to help customers mitigate this issue and has provided further customer recommendations and updated binaries for their product. More information is available at https://www.solarwinds.com/securityadvisory.
For more information and guidance from Microsoft, read:
The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. The Microsoft Threat Intelligence investigation identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as NOBELIUM.
Microsoft Threat Intelligence has identified highly targeted social engineering attacks using credential theft phishing lures sent as Microsoft Teams chats by the threat actor that Microsoft tracks as Midnight Blizzard (previously tracked as NOBELIUM).
Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, which is used by a threat actor we track as NOBELIUM to maintain persistent access to compromised environments.
In the final post of a four-part series on the NOBELIUM nation-state attack, we explore key findings from the after-action report on the attack.
