CISA has subsequently issued supplemental guidance to Emergency Directive (ED) 21-01, most recently on January 6, 2021. ( Updated January 6, 2021): On December 13, 2020, CISA released Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise, ordering federal civilian executive branch departments and agencies to disconnect affected devices. Refer to /supply-chain-compromise for additional resources. CISA will update this Alert as new information becomes available. CISA is continuing to work to confirm initial access vectors and identify any changes to the tactics, techniques, and procedures (TTPs). Specifically, we are investigating incidents in which activity indicating abuse of Security Assertion Markup Language (SAML) tokens consistent with this adversary’s behavior is present, yet where impacted SolarWinds instances have not been identified. Note ( updated January 6, 2021): CISA has evidence that there are initial access vectors other than the SolarWinds Orion platform and has identified legitimate account abuse as one of these vectors (for details refer to Initial Access Vectors section). For clarity, the Alert now lists these platform versions that share the same DLL version number separately, as both are considered affected versions. Note: prior versions of this Alert included a single bullet that listed two platform versions for the same DLL. ( Updated January 6, 2021): One of the initial access vectors for this activity is a supply chain compromise of a Dynamic Link Library (DLL) in the following SolarWinds Orion products (see Appendix A). CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations. This APT actor has demonstrated patience, operational security, and complex tradecraft in these intrusions.
government agencies, critical infrastructure entities, and private sector organizations by an advanced persistent threat (APT) actor beginning in at least March 2020. The Cybersecurity and Infrastructure Security Agency (CISA) is aware of compromises of U.S. For more information on SolarWinds-related activity, go to and.
Additional information may be found in a statement from the White House. Government attributes this activity to the Russian Foreign Intelligence Service (SVR).
0 kommentar(er)
