The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed details of a new advanced persistent threat (APT) that’s leveraging the Supernova backdoor to compromise SolarWinds Orion installations after gaining access to the network through a connection to a Pulse Secure VPN device.
“The threat actor connected to the entity’s network via a Pulse Secure virtual private network (VPN) appliance, moved laterally to its SolarWinds Orion server, installed malware referred to by security researchers as SUPERNOVA (a .NET web shell), and collected credentials,” the agency said on Thursday.
CISA said it identified the threat actor during an incident response engagement at an unnamed organization and found that the attacker had access to the enterprise’s network for nearly a year through the use of the VPN credentials between March 2020 to February 2021.
Interestingly, the adversary is said to have used valid accounts that had multi-factor authentication (MFA) enabled, rather than an exploit for a vulnerability, to connect to the VPN, thus allowing them to masquerade as legitimate teleworking employees of the affected entity.
In December 2020, Microsoft disclosed that a second espionage group may have been abusing the IT infrastructure provider’s Orion software to drop a persistent backdoor called Supernova on target systems. The intrusions have since been attributed to a China-linked threat actor called Spiral.
Unlike Sunburst and other pieces of malware that have been connected to the SolarWinds compromise, Supernova is a .NET web shell implemented by modifying an “app_web_logoimagehandler.ashx.b6031896.dll” module of the SolarWinds Orion application. The modifications were made possible by leveraging an authentication bypass vulnerability in the Orion API tracked as CVE-2020-10148, in turn allowing a remote attacker to execute unauthenticated API commands.
An investigation into the incident is ongoing. In the meantime, CISA is recommending organizations to implement MFA for privileged accounts, enable firewalls to filter unsolicited connection requests, enforce strong password policies, and secure Remote Desktop Protocol (RDP) and other remote access solutions.