In December 2020, a routine update was released for SolarWinds’ Orion software—a seemingly harmless file that approximately 18,000 organizations worldwide, including the U.S. Treasury and Department of Homeland Security, installed on their sensitive servers. What followed was not a simple intrusion, but a blueprint that has inspired supply chain attackers in the years since.
Phase One: Infiltrating the Development Environment
The attackers—later identified as UNC2452 and APT29 (believed to be affiliated with Russia’s Foreign Intelligence Service)—first breached the internal infrastructure of SolarWinds’ engineering team. According to Mandiant, they gained access to the network by exploiting a VPN server whose default password had never been changed. This was the attack’s first clear lesson: a lapse in basic authentication hygiene became the gateway to one of the largest cyber-espionage operations in history.
Phase Two: Injecting the SUNBURST Backdoor
In the next step, the attackers injected malicious code named SUNBURST into the Orion update package. Engineered with precision, the malware concealed itself among tens of thousands of lines of legitimate code and would only activate under specific execution conditions. According to Microsoft, before executing, the malware inspected the system clock, domain name, and running processes to evade detection in sandbox analysis environments. This level of stealth delayed discovery by months.
Phase Three: Lateral Movement and Data Exfiltration
Once activated, SUNBURST established an encrypted channel to the attackers’ command-and-control server and escalated privileges. Subsequently, tools such as TEARDROP and Cobalt Strike were deployed within the network. By exploiting SAML tokens, the attackers bypassed multi-factor authentication—a technique that, according to X-Force Threat Intelligence reports, remains one of the most effective methods for circumventing MFA to this day.
Phase Four: Erasing the Footprint
What made this operation remarkable was the attackers’ sophistication in covering their tracks. After achieving their objectives, they deleted the accounts they had created and removed temporary files. According to CrowdStrike, this behavior meant the attack was only discovered when Fireye noticed suspicious DNS communications to an unknown server—nearly 14 months after the initial compromise.
Implications and Lessons for Iran’s Technology Ecosystem
According to a 2024 Gartner report, supply chain attacks have more than tripled over the past three years and now account for 15% of all organizational breaches. In Iran, given the widespread reliance on open-source and foreign software, this threat takes on a more concerning dimension. Organizations that deploy products from international vendors in monitoring, backup, or network security must implement a “zero trust” principle—not only across their networks, but also with respect to their software suppliers.
Three Immediate Actions for IT Leaders
First, an SBOM (Software Bill of Materials) should be compiled for all critical software so that, in the event a vulnerability is disclosed, affected systems can be rapidly identified. Second, updates—particularly those for infrastructure tools—must be tested in an isolated environment and deployed to production servers only after hash integrity has been verified. Third, multi-factor authentication should be based on FIDO2 or hardware keys rather than SMS or TOTP-based applications, which have proven vulnerable in certain targeted attacks.
The SolarWinds attack demonstrated that even the most security-conscious organizations become vulnerable when their trust in a supplier is blind. In today’s threat landscape, true defense is built on transparency, continuous monitoring, and constant reassessment of the chain of trust—an approach that the Razban team at Razban Technology Atlas has made the foundation of its security advisory practice.
