Hackers were present in SolarWinds’ systems as early as January 2019, months earlier than previously reported, SolarWinds President and CEO Sudhakar Ramakrishna revealed during an appearance at the 2021 RSA Conference (RSAC).
Ramakrishna disclosed the new information in a discussion with Forrester VP Laura Koetzle, who quizzed the CEO during a pre-taped interview for the all-virtual RSAC.
“The tradecraft the attackers used was extremely well done and extremely sophisticated,” said Ramakrishna, allowing them to hide in plain sight. The attack was possible, he added, because the attackers had the resources of a nation-state behind them. The US government has attributed the attack to Russia.
A continuing review of the SolarWinds systems, which Ramakrishna described as hundreds of gigabytes of information, currently shows that attackers “may have been in our environment as early as January 2019.” He didn’t go into detail about what they were doing at that point, except to characterize their actions as “very early recon activities.”
That hack was not made public until December 2020, when it was revealed that attackers had gained access to thousands of companies and US government agencies. It was a complex supply chain attack that used multiple exploits and moved through intermediary companies, like SolarWinds, before attackers reached their targets.
The entry point was the SolarWinds Orion software. Attackers compromised the SolarWinds system for distributing software updates, and used that to spread malware to its customers, giving the attackers a beachhead anywhere the malicious update was applied. Previously, the start date for the attack was thought to have been sometime earlier than October 2019, which is the point that attackers first modified a SolarWinds update.
In addition to the new information on the attack timeline, Ramakrishna also described the lengths that SolarWinds is taking to help affected customers recover from the attack, and stressed the importance of transparency when coping with a breach like this.
When asked what he would have done differently, Ramakrishna said he wished that SolarWinds had put greater investment into its PR operations, so that it could have better engaged with the public as news of the attack broke. He concluded by underlining the severity of the attack, saying, “I do not wish something like this to happen to anybody in the industry.”
