SolarWinds
A U.S.-based IT management software company, widely known for the 2020 supply chain attack in which threat actors implanted a backdoor into its Orion network monitoring software. The compromised software was distributed to approximately 18,000 government and enterprise customers.
Core Facts
The 2020 SolarWinds incident was one of the largest supply chain attacks to date, in which attackers planted a backdoor in the Orion software build process, affecting approximately 18,000 organizations
Backdoor code was planted in the 2020 SolarWinds supply chain attack.
2020年SolarWinds事件中，攻击者通过污染软件构建流程将后门植入正版软件更新包，渗透美国多个政府机构
Timeline (last 90 days)
A self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
The 2021 SolarWinds incident and the 2022 node-ipc poisoning incident drove the adoption of the SLSA framework.
Incidents such as SolarWinds and XZ Utils have shown that widely trusted open-source projects can also become targets of supply chain attacks.
The SolarWinds supply chain attack, which occurred in 2020, is a landmark case of its kind of APT intrusion, and similarly went undetected for months.
Software supply chain security has received widespread attention in recent years due to major incidents such as Log4Shell and SolarWinds.
In 2021, the SolarWinds incident and npm malicious package poisoning events made the industry aware that every step in the pipeline from source code to end users for build artifacts could be tampered with.
In the 2020 SolarWinds incident, attackers injected malicious code into the build pipeline, ultimately affecting tens of thousands of downstream users.
The SolarWinds incident occurred in 2020, when attackers compromised SolarWinds' build environment and planted malicious code into Orion software update packages, causing approximately 18,000 customers worldwide to install the backdoored version
The SolarWinds incident in 2021 affected thousands of enterprises and government agencies.
The SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
4 more timeline events
All Facts (20)
The 2020 SolarWinds incident was one of the largest supply chain attacks to date, in which attackers planted a backdoor in the Orion software build process, affecting approximately 18,000 organizations
90%VerifiedBackdoor code was planted in the 2020 SolarWinds supply chain attack.
85%Verified2020年SolarWinds事件中，攻击者通过污染软件构建流程将后门植入正版软件更新包，渗透美国多个政府机构
80%VerifiedThe 2021 SolarWinds incident and the Log4j vulnerability made the industry realize that widely trusted tools could also become attack entry points.
70%Unverified美国政府在SolarWinds和Log4Shell事件后发布行政令要求推行软件物料清单（SBOM），欧盟推出《网络弹性法案》将开源软件安全责任纳入监管框架
90%UnverifiedA self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
50%UnverifiedIncidents such as SolarWinds and XZ Utils have shown that widely trusted open-source projects can also become targets of supply chain attacks.
50%UnverifiedThe SolarWinds supply chain attack, which occurred in 2020, is a landmark case of its kind of APT intrusion, and similarly went undetected for months.
50%UnverifiedSoftware supply chain security has received widespread attention in recent years due to major incidents such as Log4Shell and SolarWinds.
50%UnverifiedThe SolarWinds incident occurred in 2020, when attackers compromised SolarWinds' build environment and planted malicious code into Orion software update packages, causing approximately 18,000 customers worldwide to install the backdoored version
50%UnverifiedFollowing the SolarWinds incident and the Log4Shell vulnerability, the U.S. White House issued Executive Order EO 14028, requiring software vendors to provide an SBOM (Software Bill of Materials).
50%UnverifiedAPT29, also known as Cozy Bear or Midnight Blizzard, is an advanced persistent threat group associated with Russian intelligence agencies and was involved in the 2020 SolarWinds supply chain attack.
50%UnverifiedAPT29 (also known as Cozy Bear or Midnight Blizzard) is an advanced persistent threat group affiliated with Russian intelligence agencies and was involved in the 2020 SolarWinds supply chain attack.
50%Unverified2020年的SolarWinds事件中攻击者在Orion平台构建过程中植入后门，影响了全球超过18000个组织，包括多个美国联邦政府机构
50%UnverifiedThe 2021 SolarWinds incident and the 2022 node-ipc poisoning incident drove the adoption of the SLSA framework.
50%UnverifiedIn 2021, the SolarWinds incident and npm malicious package poisoning events made the industry aware that every step in the pipeline from source code to end users for build artifacts could be tampered with.
50%UnverifiedThe 2020 SolarWinds supply chain attack affected more than 18,000 organizations, including the U.S. Department of the Treasury.
60%UnverifiedIn the 2020 SolarWinds incident, attackers injected malicious code into the build pipeline, ultimately affecting tens of thousands of downstream users.
50%UnverifiedThe SolarWinds incident in 2021 affected thousands of enterprises and government agencies.
50%UnverifiedThe SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
50%