MyRecon OSINT

← Case Files · The Breach Files

2020 · Supply chain

SolarWinds, 2020: 18,000 organisations installed the backdoor themselves

Case file · 5 min read · Published 14 September 2026

People affected
~18,000 organisations downloaded the backdoor
When it happened
September 2019 – June 2020
Made public
8 December 2020
How they got in
Malicious code inserted into the SolarWinds Orion build pipeline and distributed as a digitally signed update
Attributed to
APT29 / Cozy Bear, attributed by the US government to Russia's SVR foreign intelligence service
What it cost
Tens of millions in direct costs to SolarWinds; the SEC later sued the company and its security chief

What was exposed: Government and corporate email · Internal network access · Source code · Authentication tokens

Every piece of security advice about software updates says the same thing: install them promptly, get them from the vendor, check the signature. In 2020, around 18,000 organisations did exactly that and installed a Russian intelligence backdoor. The update was genuine. It came from the real vendor, over the real update channel, signed with the real certificate. The compromise sat upstream of every control anyone had.

What happened

SolarWinds makes Orion, a network monitoring platform. Software of that kind occupies a particular position inside an organisation: to monitor a network it has to see the whole network, and to see the whole network it needs privileges almost nothing else is given. Orion was installed in US federal departments, across much of the Fortune 500, in telecoms operators, and in security companies.

Some time around September 2019, attackers gained access to SolarWinds' software build environment. They did not tamper with the source repository in any way a developer would notice. They interfered with the build itself, so that when Orion was compiled the resulting binary contained code that was in nobody's checkout. The build system then did what build systems do: signed the output with SolarWinds' code-signing certificate and published it as an official release.

Between March and June 2020, updates carrying that backdoor — named SUNBURST — went out to customers who had done nothing wrong except keep their software current.

Why a build system is the highest-value target in software. Source code gets reviewed, and a malicious commit has an author, a timestamp and a diff. A build system has none of that. It is the last point at which code is still changeable and the first point at which it is trusted, and its output inherits the vendor's signature automatically. Compromise it and you do not have to defeat code review, code signing or the customer's patch policy. You inherit all three.

The backdoor was built to be boring

SUNBURST's design shows an unusual amount of patience. After installation it lay dormant for up to two weeks before doing anything at all. It checked the domain it had landed on and stopped if the environment looked like a malware analysis sandbox. It refused to run when certain security tools were present. Its command-and-control traffic was formatted to resemble Orion's own legitimate telemetry, so a defender reading network logs saw monitoring software sending monitoring data.

That restraint was the operationally significant decision. A backdoor talking on 18,000 networks is loud. One that chooses to speak on a few dozen of them is not. The attackers were never trying to exploit 18,000 organisations — they were using 18,000 organisations as a catalogue to select from.

Who was selected

The confirmed follow-on victims read as a national security list: the US Treasury, the Commerce Department's telecommunications agency, and the Departments of State, Homeland Security, Energy and Justice, including the National Nuclear Security Administration. Microsoft confirmed that attackers had viewed some of its source code. Several cybersecurity vendors were hit as well.

It was one of those vendors that ended the campaign. FireEye discovered in late 2020 that its own red-team tooling had been stolen, investigated, traced the intrusion back to Orion, and published on 8 December. SolarWinds confirmed on 13 December. CISA issued an emergency directive within a day ordering federal agencies to disconnect Orion from their networks entirely.

Nobody knows how much longer the campaign would have run otherwise. Detection came from a victim that happened to have both the visibility to notice and the willingness to say so in public, which is not a control any organisation can plan around.

The timeline

  1. September 2019 — Attackers gain access to the SolarWinds build environment and test their ability to inject code into a build without being noticed.
  2. February 2020 — SUNBURST is compiled into an Orion build.
  3. March – June 2020 — Trojanised updates are distributed to customers through the normal release channel.
  4. 8 December 2020 — FireEye discloses its own compromise and traces it to Orion.
  5. 13 December 2020 — SolarWinds confirms; CISA issues Emergency Directive 21-01 the following day.
  6. April 2021 — The US government formally attributes the campaign to Russia's SVR and imposes sanctions.
  7. October 2023 — The SEC sues SolarWinds and its chief information security officer over the company's security disclosures; most of the case is dismissed in July 2024.

What it changed

Software supply chain security became a funded discipline. Before SolarWinds it was a research topic. Afterwards the US issued an executive order requiring vendors selling to government to attest to their build practices, and the software bill of materials — an ingredients list for software — went from a niche proposal to a procurement requirement.

Signed stopped meaning safe. The signature proved the file came from SolarWinds. It did not, and could not, prove that what SolarWinds built was what SolarWinds intended to build. Reproducible builds, where an independent party compiles the same source and gets a byte-identical binary, moved from an idealist's project to something major vendors actually do.

Security executives started reading their own disclosures like lawyers. The SEC's decision to name a chief information security officer personally in an enforcement action was, whatever its legal merits, noticed in every security team in the country. The complaint was largely dismissed, but the question it raised — what gets said publicly versus what is known internally — did not depend on the outcome.

"Trusted vendor" stopped being a category. Monitoring platforms, endpoint agents, backup software and remote access tools all share Orion's profile: deep privilege, broad reach, automatic updates. Many organisations now segment them, restrict their outbound network access, and treat an update channel as an attack surface rather than a convenience.

What to take from it

  1. Assume your most privileged software is also your largest exposure. The tools with the widest access are the ones worth attacking, and they are usually the ones nobody wants to restrict.
  2. Give management software an outbound allowlist. SUNBURST had to reach the internet to be useful. A monitoring platform that can only talk to the things it monitors is a much smaller problem.
  3. Know which vendors can run code on your machines. Any vendor shipping you automatic updates has that power. The list is usually longer than people expect and almost never written down.
  4. For individuals the lesson is narrower but real. Take updates from the vendor rather than a mirror or a bundled installer. Supply chain attacks that reach consumers almost always arrive through the unofficial route, not the official one.

Checked against every breach on record, against public breach data only. Your address is not sent to us as a form and is not stored — it is handed straight to the lookup tool in your own browser. See the privacy policy.

Questions people ask

Was SolarWinds a data breach?

Not in the usual sense. Almost no consumer records were stolen. What was stolen was access — to US federal departments, to security vendors, to technology companies — and in several cases email, source code and authentication material. It matters because it changed what the industry counts as a breach: the asset taken was a position inside other people's networks.

How many organisations were actually compromised?

Around 18,000 SolarWinds customers downloaded a trojanised Orion update. That number is usually quoted as the scale of the attack, and it overstates the damage. The backdoor only phoned home; the attackers then selected a much smaller set — commonly reported as fewer than 100 organisations — for hands-on intrusion. Everyone else had a dormant backdoor and a very bad month of incident response.

Who was behind the SolarWinds attack?

In April 2021 the US government formally attributed it to the SVR, Russia's foreign intelligence service. The industry tracks the same activity as APT29 or Cozy Bear. Russia denied involvement and no individual has been prosecuted.

What is SUNBURST?

SUNBURST is the name FireEye gave to the backdoor inserted into SolarWinds Orion. It was written to resemble ordinary Orion code, waited up to two weeks before activating, checked whether it was running inside a researcher's analysis environment, and disguised its command traffic as Orion's own telemetry protocol.

Sources

Read next

Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.

← All case files Breach archive →