Baitaphish
Security intelligence
SearchLatest briefing
Curated incident record

SolarWinds Orion supply chain compromise impacts government and enterprise networks

A supply chain compromise of SolarWinds Orion involved the distribution of maliciously modified software updates, enabling unauthorized access to affected customer environments. CISA issued an emergency directive for federal civilian agencies and published guidance on detection and response, while SolarWinds disclosed details and risks in SEC filings. The incident triggered broad remediation efforts across government and industry and remains a major reference case for software supply chain risk management.
First reported December 13, 2020Supply Chainhigh overall confidence
Incident library
First reportedDecember 13, 2020
ActivityMarch 1, 2020
Last updatedFeb 2, 2026, 12:00 AM UTC
Record confidencehigh

Key facts

Affected

  • SolarWinds Orion customers (public and private sector)
  • U.S. federal civilian agencies (per CISA directive)

Initial access

  • supply_chain

Impact

  • data_theft
  • unknown
  • financial_loss

Attribution

unknown med confidence

Government advisories describe the compromise and response actions; definitive public attribution varies by public reporting and is not asserted here from the cited primary sources.

CVEs and ATT&CK

CVEs

ATT&CK techniques

T1195.002 · high
  • T1195.002: The compromise involved malicious code delivered through a software update mechanism, consistent with compromise of a software supply chain.

Mitigations

Now

  • Verify software update integrity and restrict update channelsReduces risk of consuming malicious updates and limits update traffic to known, validated endpoints.

Soon

  • Strengthen build and release pipeline security (signing keys, least privilege, monitoring)Protects upstream systems that can distribute attacker-controlled code to many downstream environments.

Later

  • Require SBOMs and third-party security attestations for critical suppliersImproves visibility into dependencies and enables faster response when supplier compromises occur.

Detection ideas

Monitor for unusual outbound connections from recently updated software

Alert when newly updated binaries initiate new or rare external connections, especially to unfamiliar domains or IP ranges.

Data sources: DNS logs, Proxy logs, EDR telemetry

Detect unexpected persistence or new services after update

Alert on creation of new services, scheduled tasks, or startup items immediately following a software update outside change windows.

Data sources: EDR telemetry, Windows Security Event Logs, Configuration management logs

Sources