Security News > 2021 > February > CISA Says Many Victims of SolarWinds Hackers Had No Direct Link to SolarWinds
The U.S. Cybersecurity and Infrastructure Security Agency says many of the victims of the threat group that targeted Texas-based IT management firm SolarWinds were not directly linked to SolarWinds.
"While the supply chain compromise of SolarWinds first highlighted the significance of this cyber incident, our response has identified the use of multiple additional initial infection vectors. We have found that significant numbers of both the private-sector and government victims linked to this campaign had no direct connection to SolarWinds," a CISA spokesperson told SecurityWeek.
CISA's acting director, Brandon Wales, told The Wall Street Journal last week that roughly 30% of the victims identified by the agency did not have a direct connection to SolarWinds.
CISA warned shortly after the SolarWinds breach came to light that the supply chain compromise was not the only initial attack vector leveraged by the threat group, which the U.S. government and others have linked to Russia.
The attackers have also been known to target organizations through Microsoft services and WSJ cited a person familiar with the SolarWinds investigation saying that SolarWinds has been trying to determine if its own network was initially breached through Microsoft services.
CISA did not clarify whether victims with "No direct connection to SolarWinds" included organizations that had received the malicious updates but did not actually use the software.