SolarWinds (Sunburst) compromise
An espionage campaign revealed in December 2020 that trojanized an update of a monitoring software installed at eighteen thousand customers, which Washington attributed to Russian foreign intelligence before sanctioning Moscow.
The SolarWinds compromise, known as Sunburst after the backdoor used, is a software supply chain attack revealed in December 2020. The attackers had inserted malicious code into updates of Orion, a network monitoring product, distributed through normal channels and signed by the vendor. About eighteen thousand customers installed them, but the attackers exploited the access at only a small fraction of them, including several US federal agencies. For the underwriter, the case is an instructive counterexample. The number of exposed organizations was considerable, and yet insured losses stayed modest, because the operation sought intelligence rather than destruction or extortion: no encryption, no business interruption, few notifications. Cyber accumulation is therefore measured not by the number of systems reached but by the attacker's intent and the type of damage it produces. The case also illustrates the political junction: official attribution, expulsion of diplomats and economic sanctions followed, without the operation ever being characterized as an act of war.
On April 15, 2021, the White House formally attributed the campaign to the Russian foreign intelligence service and, the same day, an executive order imposed new sanctions on Russia and expelled ten Russian diplomats.
Sunburst, SolarWinds compromise, SolarWinds Orion
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.