In yet another twist to the recently revealed major cyber espionage campaign waged by apparent Russian nation-state actors, SolarWinds' network management platform was not the only initial infection vector for the sophisticated attacks, according to the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA).
CISA revealed that juicy tidbit today in a cyber activity alert that calls the attacks a "grave risk" to government agencies, critical infrastructure organizations, and the private sector. The SolarWinds Orion network management platform initially was thought to be the main attack vector; the attackers injected malware into the SolarWinds application, so when users installed an update, they were infected with the stealthy code.
"CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated. CISA will update this Alert as new information becomes available," the agency said in the report.
The agency is investigating incidents where victims were compromised in the same campaign but without the malicious Orion code. They also point to security vendor Volexity's report of a think tank that was compromised via an attack that bypassed Duo multifactor authentication to reach its Outlook Web App.
"Volexity attributes this intrusion to the same activity as the SolarWinds Orion supply chain compromise, and the TTPs are consistent between the two. This observation indicates that there are other initial access vectors beyond SolarWinds Orion, and there may still be others that are not yet known," CISA said.
"This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks. O ..
Support the originator by clicking the read the rest link below.
