The SolarWinds attack really opened the eyes of a lot of security professionals to supply chain attacks. Supply chain attacks are those you inherit when purchasing a technology meaning the compromise happens before the technology arrives and you just end up being owned. New research shows there is another malware levering the SolarWinds attack. The Hacker News posted about it HERE. Here is part of that article …
The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary’s ability to maintain persistent access for years.
According to cybersecurity firm CrowdStrike, which detailed the novel tactics adopted by the Nobelium hacking group last week, two sophisticated malware families were placed on victim systems — a Linux variant of GoldMax and a new implant dubbed TrailBlazer — long before the scale of the attacks came to light.
Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion in December 2020, is also tracked by the wider cybersecurity community under the names UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (Crowdstrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).
continue reading at New Malware Used by SolarWinds Attackers Went Undetected for Years (thehackernews.com)
