Trend data on the SolarWinds Orion compromise

What this post added

This post details the analysis of DNS query traffic to malicious hostnames associated with the SolarWinds Orion compromise, observed through Cloudflare's 1.1.1.1 resolver. It highlights the use of Domain Generation Algorithms (DGAs) for C2 server discovery and data exfiltration, and the observed trends in query volume, subdomain generation, and geographic distribution of the attack. It also outlines Cloudflare Gateway's role in blocking these C2 domains and assisting customers in identifying potential compromises.