#SUPERNOVA SOLARWINDS SOFTWARE#
#SUPERNOVA SOLARWINDS CODE#

In a statement, a SolarWinds spokesman did not address SUPERNOVA, but said the company 'remains focused on collaborating with customers and experts to share information and work to better understand this issue.' It's also possible that the SUPERNOVA and SUNBURST attacks represent the actions of separate nations attempting to use SolarWinds products to penetrate other high-value U.S. One such case was the breach of the Democratic National Committee's servers in 2016, when CrowdStrike researchers found evidence that Russian hacking groups dubbed Fancy Bear and Cozy Bear had both broken into the system. In past breaches, security researchers have found evidence that more than one suspected Russian hacking group penetrated the same system, duplicating their efforts in a way that suggested each did not know what the other was doing. The SUNBURST backdoor was first deployed in March, though the same group behind it appears to have tampered with SolarWinds products as early as October 2019. The malware appears to have been created in late March, based on a review of the file's compile times. It is unclear whether SUPERNOVA has been deployed against any targets, such as customers of SolarWinds. The second backdoor is a piece of malware that imitates SolarWinds' Orion product but it is not 'digitally signed' like the other attack, suggesting this second group of hackers did not share the same access to the network management company's internal systems.

'The investigation of the whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product but has been determined to be likely unrelated to this compromise and used by a different threat actor,' Microsoft said in a security blog on Friday. It comes after President Donald Trump contradicted members of his own administration to suggest that China may be behind the sprawling attack, which compromised key federal agencies. The second backdoor, dubbed SUPERNOVA by security experts, appears distinct from the SUNBURST attack that has been attributed to Russia,В raising the possibility that multiple adversaries were attempting parallel attacks, perhaps unbeknownst to each other.

#SUPERNOVA SOLARWINDS SOFTWARE#

Microsoft researchers say a second unidentified hacking team installed a backdoor in the same SolarWinds network software that facilitated a massive cyber espionage campaign, as the number of victims in the attack rose to 200. Experts say the extent of the information stolen may never be knownД«y Keith Griffith For and Reuters.The attack has been described as the cyber equivalent of Pearl Harbor.Expert tells : 'Cyber attribution is exceptionally complex'.Trump broke his silence to contradict Pompeo and insists China may be to blame.

Mike Pompeo attributed the more damaging SUNBURST attack to Russia.

Microsoft researchers dub it SUPERNOVA and say it it likely from a second team.

#SUPERNOVA SOLARWINDS CODE#

Now second backdoor has been discovered in compromised SolarWinds code.

Nine-month espionage campaign gave hackers untold access to secrets.

So far most victims are government agencies, tech companies and contractors.

Malware was downloaded by 18,000 groups but only activated on a handful.

Security researchers have identified nearly 200 victims of SUNBURST attack.

Microsoft discovers SECOND hacking team dubbed 'Supernova' installed backdoor in SolarWinds software in March - as Feds say first Russian 'act of war' cyber attack struck at least 200 firms and US federal agencies

Supernova solarwinds