The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.(Citation: CrowdStrike StellarParticle January 2022) Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.(Citation: SolarWinds Advisory Dec 2020) (Citation: SolarWinds Sunburst Sunspot Update January 2021) (Citation: FireEye SUNBURST Backdoor December 2020) (Citation: Volexity SolarWinds) (Citation: CrowdStrike StellarParticle January 2022) (Citation: Unit 42 SolarStorm December 2020) (Citation: Microsoft Analyzing Solorigate Dec 2020) (Citation: Microsoft Internal Solorigate Investigation Blog) In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021) (Citation: UK NSCS Russia SolarWinds April 2021) (Citation: Mandiant UNC2452 APT29 April 2022) The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.(Citation: USG Joint Statement SolarWinds January 2021)

Created

Mar 24, 2023, 2:59 PM UTC

Modified

Jul 31, 2026, 6:47 PM UTC