SolarWinds Orion and UNC2452 - Summary and Recommendations

### Executive Summary This TrustedSec guidance describes the SolarWinds Orion supply-chain compromise by the UNC2452 actor (SUNBURST backdoor) that distributed digitally signed, backdoored Orion updates (Mar–Jun 2020), discusses follow-on activity including TEARDROP memory-only droppers and Cobalt Strike deployment, and provides remediation, hunting guidance, Active Directory/Azure AD hardening recommendations, and references to IOCs and external technical resources.