Additional Analysis into the SUNBURST Backdoor

Executive summary: This McAfee ATR analysis examines the SUNBURST backdoor embedded in SolarWinds.Orion.Core.BusinessLayer.dll, describing how it establishes persistence and stealth via long dormancy, a hardcoded named pipe, system fingerprinting (MD5 UID), service/registry manipulation, extensive system and network reconnaissance, proxy credential harvesting, and DGA-based C2 communications (subdomains of avsvmcloud.com with listed examples and CNAMEs); it highlights indicators and urges further remediation to detect any additional persistence mechanisms.