Between March and June 2020, attackers shipped a trojanized software update for SolarWinds Orion. The campaign, attributed to the Russian threat actor UNC2452 (Nobelium), breached 18,000 victims protected by best-in-class security stacks. FireEye discovered it nine months later. Managed adam:ONE® networks running in Zero Trust Connectivity (ZTc) configuration were not affected, even though nobody knew the attack existed.
The breach
- The trojanized Orion software update was distributed from March to June 2020.
- The threat actors were based in Russia: APT UNC2452, also known as Nobelium.
- FireEye discovered the attack only nine months later.
- 30% of the attacks were on companies with no direct link to SolarWinds, reached through compromised cloud services.
- The defenses of the world’s top security systems failed because they depended on detecting the attack.
Who was breached
The 18,000 victims included:
- US Treasury Department
- Cybersecurity and Infrastructure Security Agency (CISA)
- Department of Homeland Security (DHS)
- US Department of State
- US Department of Energy (DOE)
- FireEye, the US cybersecurity firm now known as Mandiant and acquired by Google
- US Department of Commerce NTIA
- National Institutes of Health (NIH)
- Fortune 500 companies
Why ZTc networks were unaffected
Every managed adam:ONE user in ZTc configuration was protected from day zero, without anyone knowing the attack existed. adam:ONE blocked every exfiltration channel and the command-and-control traffic by default, because none of it went to a verified destination.
Once FireEye made the threat public, ADAMnetworks reviewed the logs. Every attempted connection had been neutralized, along with every other unverified or unknown DNS or IP connection request. That outcome matches CISA’s statement that proper egress control could have mitigated the attack.
Outcomes
- ADAMnetworks technology protected its users against advanced persistent threat attacks such as the SolarWinds breach and Pegasus.
- Users were protected before the threats became known, without relying on detection by any next-generation system or endpoint software.
