SUNBURST

Sunburst is a sophisticated malware that was detected in a major supply chain attack in December 2020. The Sunburst backdoor has been tied to Kazuar, another malicious software, due to code resemblance, indicating its high level of complexity. This malware infiltrates systems, often without the user's knowledge, via suspicious downloads, emails, or websites, and can steal personal information, disrupt operations, or hold data for ransom. Prominent campaigns such as DarkHydrus, OilRig, xHunt, SUNBURST, and Decoy Dog have leveraged DNS tunneling for command and control (C2), highlighting the shared techniques across these threats. The discovery of the Sunburst malware led to significant challenges for many organizations, including governments around the world. Following the disclosure of IP addresses associated with the Sunburst attackers, organizations had to painstakingly sift through historical data to identify impacted services and any potential interactions with the malware. In July 2024, US District Judge Paul Engelmayer dismissed most of the charges against SolarWinds and Brown, stating that the Securities and Exchange Commission's (SEC) claims that they concealed the firm’s security weaknesses post-Sunburst were based on "hindsight and speculation.” Partners, including in the US, have associated Nobelium, the group behind Sunburst, with APT29, which was also implicated in the 2015 attack against the American Democratic National Committee and the 2020 Sunburst attack targeting SolarWinds products. Following the Sunburst supply chain attack, the Biden administration took measures to bolster the nation’s cybersecurity. Chris DeRusha, federal CISO and deputy national cyber director, and Eric Goldstein, executive assistant director for cybersecurity at CISA, cited Executive Order 14028, which led to these initiatives aimed at ensuring secure development and bolstering government cybersecurity.