Rewterz Threat Alert – SUPERNOVA Malware Linked with SolarWinds and Pulse Secure Exploits

Severity

High

Analysis Summary

SUPERNOVA malware is a relatively new malware that is linked with SolarWinds Orion and Pulse Secure Virtual Private Networks (VPNs). In the beginning, the SolarWinds Orion tech was being targeted to install the malware separately onto servers that needed unauthorized access to the system network.

As the previous alert explained: “The SUPERNOVA malware consisted of two components. The first was malicious, unsigned [.NET] webshell… specifically written to be used on the SolarWinds Orion Platform. The second is the utilization of a vulnerability in the Orion Platform to enable deployment of the malicious code. This vulnerability in the Orion Platform has been resolved in the latest updates.”

US IP addresses were used by threat actors to masquerade as teleworking employees. Pulse Secure VPN appliances were the initial door for the malware to enter, and it was laterally moved to the SolarWinds Orion Server. The threat actors exploited CVE-2020-10148, an authentication bypass flaw in the SolarWinds Orion API that enabled them to execute API commands. The API was exploited and used to run commands.

Impact

Remote Access

Affected Vendors

• Pulse Connect
• SolarWinds

Indicators of Compromise

IP

• 207[.]89[.]9[.]153
• 24[.]140[.]28[.]90
• 24[.]117[.]18[.]111

Remediation

Refer to ICS advisory for the complete list of mitigations and recommendations.

https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a