The Hitchhiker’s Guide to SolarWinds Incident Response

Zscaler outlines the SolarWinds Orion supply-chain attack in which an advanced adversary inserted a digitally-signed backdoor (SUNBURST) into Orion updates distributed March–December 2020. The report lists affected Orion versions, network indicators (domains and IPs), file indicators (MD5 hashes and filename), observable malicious behaviors and user-account activity, and provides investigative and mitigation recommendations for affected organizations.