-
Are you a MSP or use a MSP?
Edit: At this time, we are not aware of an impact to our SolarWinds MSP products including RMM and N-central.
Looks to be only to their enterprise customers at this time.
Edit: A twitterized version of the write up on the Microsoft threat analytics site can be read here:
https://threadreaderapp.com/thread/1338305089597964290.html
Here’s the key takeaway:
we do not know how the backdoor code made it into the library..research indicates…the attackers might have compromised internal build or distribution systems of SolarWinds, embedding backdoor..into a legitimate SolarWinds library” – SolarWinds.Orion.Core.BusinessLayer.dll
Another good write up at Fireeye
If you are a managed service provider or use a managed service provider to support you and your IT… read on…
If you’re a SolarWinds customer & use the below product, assume compromise and immediately activate your incident response team. Odds are you’re not affected, as this may be a resource intensive hack. Focus on your Crown Jewels. You can manage this. https://t.co/YvSGTv926a https://t.co/WFe89831Dj
— Chris Krebs (@C_C_Krebs) December 13, 2020
Word is coming out tonight that SolarWinds was the entry point into various targeted attacks that have been in the news lately including FireEye.
Just got this from @solarwinds:https://t.co/30EClmPXqw pic.twitter.com/1yjYp6lUyf
— Raphael Satter (@razhael) December 13, 2020