Security News > 2021 > April > Hackers Exploit VPN to Deploy SUPERNOVA malware on SolarWinds Orion

The U.S. Cybersecurity and Infrastructure Security Agency has disclosed details of a new advanced persistent threat that's leveraging the Supernova backdoor to compromise SolarWinds Orion installations after gaining access to the network through a connection to a Pulse Secure VPN device.

"The threat actor connected to the entity's network via a Pulse Secure virtual private network appliance, moved laterally to its SolarWinds Orion server, installed malware referred to by security researchers as SUPERNOVA, and collected credentials," the agency said on Thursday.

CISA said it identified the threat actor during an incident response engagement at an unnamed organization and found that the attacker had access to the enterprise's network for nearly a year through the use of the VPN credentials between March 2020 and February 2021.

In December 2020, Microsoft disclosed that a second espionage group may have been abusing the IT infrastructure provider's Orion software to drop a persistent backdoor called Supernova on target systems.

Unlike Sunburst and other pieces of malware that have been connected to the SolarWinds compromise, Supernova is a.NET web shell implemented by modifying an "App web logoimagehandler.ashx.b6031896.dll" module of the SolarWinds Orion application.

The modifications were made possible by leveraging an authentication bypass vulnerability in the Orion API tracked as CVE-2020-10148, in turn permitting a remote attacker to execute unauthenticated API commands.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/LE_Df1CsM5o/hackers-exploit-vpn-flaw-to-deploy.html