Incident Response December 16, 2020
By Nick Rossmann < 1 min read

SolarWinds has announced a cyberattack on its systems that compromised specific versions of the SolarWinds Orion Platform, a widely used network management tool. SolarWinds reports that this incident was likely the result of a highly sophisticated, targeted and manual supply chain attack by a nation state, but it has not, to date, independently verified the origin of the attack.

Subsequently, a number of U.S. federal agencies have disclosed they were potentially victims of the hacking campaign. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued Emergency Directive 21-01 in response to this incident.

At this time, IBM recommends organizations running SolarWinds Orion take the following actions:

  • Identify, isolate and investigate any potentially impacted SolarWind Orion or associated computing environment via a comprehensive security analysis. Indicators of Compromise are available from the X-Force Exchange.
  • Take remediation actions based on investigation outcomes after evaluating unique IT environment needs. Vendor guidance and resources from SolarWinds can be leveraged as needed here.

For IBM QRadar users looking for more details on applying the available threat intelligence to their response, IBM has published a more detailed blog in the IBM Security Community available here.

IBM is closely monitoring the overall situation and is engaged with clients and the security community. More details can be found in our X-Force Exchange post, which will be updated as this situation evolves.

Assistance is also available to assist 24×7 via IBM Security X-Force’s US hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034.

 | 
Nick Rossmann
Global Lead, X-Force Threat Intelligence, IBM Security

Nick Rossmann is the Global Lead for X-Force Threat Intelligence. His teams hunt for evil and reverse engineer malware. Nick works closely with offering mana...

More from Incident Response
CISO   June 2, 2023

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read
CISO   June 1, 2023

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read
Incident Response   May 1, 2023

Expert Insights on the X-Force Threat Intelligence Index

5 min read - Top insights are in from this year’s IBM Security X-Force Threat Intelligence Index, but what do they mean? Three IBM Security X-Force experts share their thoughts on the implications of the most pressing cybersecurity threats, and offer guidance for what organizations can do to better protect themselves. Moving Left of Boom: Early Backdoor Detection Andy Piazza, Global Head of Threat Intelligence at IBM Security X-Force, sat down with Security Intelligence to chat with us about the rise in the deployment…

5 min read
Incident Response   May 1, 2023

How Morris Worm Command and Control Changed Cybersecurity

4 min read - A successful cyberattack requires more than just gaining entry into a victim’s network. To truly reap the rewards, attackers must maintain a persistent presence within the system. After establishing communication with other compromised network devices, actors can stealthily extract valuable data. The key to all this is a well-developed Command and Control (C2 or C&C) infrastructure. The number of C2 servers used for launching cyberattacks increased by 30% in 2022. More than 17,000 of these servers were detected last year,…

4 min read
© 2023 IBM Contact Privacy Terms of use Accessibility Cookie Preferences
Sponsored by si-icon-eightbarfeature