Supply Chain Exploitation of SolarWinds Orion Software | Huntress

FireEye and others discovered a SolarWinds Orion supply-chain compromise (SUNBURST/Solorigate) in which malicious, digitally-signed Orion updates (notably SolarWinds.Orion.Core.BusinessLayer.dll) were distributed between March and June 2020, enabling stealthy backdoor access, C2 communications, and in some cases administrative access and SAML token signing compromise; the report includes mitigation guidance, detection updates, and filesystem locations/IOCs for hunting.