Trend data on the SolarWinds Orion compromise
Dec 16, 2020Malavika Balachandran Tadeusz, Jesse Kipp
Summary
This post details the analysis of DNS query traffic to malicious hostnames associated with the SolarWinds Orion compromise, observed through Cloudflare's 1.1.1.1 resolver. It highlights the use of Domain Generation Algorithms (DGAs) for C2 server discovery and data exfiltration, and the observed trends in query volume, subdomain generation, and geographic distribution of the attack. It also outlines Cloudflare Gateway's role in blocking these C2 domains and assisting customers in identifying potential compromises.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack