The SolarWinds Attack

# Executive Summary This report analyzes the SolarWinds supply-chain compromise that deployed backdoors (SUNBURST, SUNSPOT, SUPERNOVA) enabling a sophisticated, likely nation-state campaign to pivot from on-premises into cloud environments (notably Office 365/Azure AD) using identity-focused techniques such as Golden SAML; it provides a timeline, known IOCs, detection and response guidance for cloud security teams, and recommends scanning, identity monitoring, and mitigation steps for affected environments.