SUNSPOT

Malware & Tools · SUNSPOT

· MalwareS0562 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

SUNSPOT is an implant that injected the SUNBURST backdoor into the SolarWinds Orion software update framework. It was used by APT29 since at least February 2020.(Citation: CrowdStrike SUNSPOT Implant January 2021)

Tactic Coverage

stealth (7)discovery (2)execution (1)privilege escalation (1)initial access (1)impact (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (12)

T1027Obfuscated Files or Information

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1057Process Discovery

discovery

T1070.004File Deletion

stealth

T1083File and Directory Discovery

discovery

T1106Native API

execution

T1134Access Token Manipulation

References

https://attack.mitre.org/software/S0562 https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/