H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SUNBURST](https://attack.mitre.org/software/S0559) is a trojanized DLL designed to fit within the SolarWinds Orion software update framework. It was used by [APT29](https://attack.mitre.org/groups/G0016) since at least February 2020.(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)

Labels

malware

38 recorded

Relationships

uses

from APT29

Group

uses

from SolarWinds Compromise

Campaign

uses

to Clear Network Connection History and Configurations

Technique

uses

to Clear Persistence

Technique

uses

to Code Signing

Technique

uses

Technique

uses

to Data from Local System

Technique

uses

to Disable or Modify Tools

Technique

uses

to DNS

Technique

uses

to Dynamic Resolution

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Image File Execution Options Injection

Technique

uses

to Indicator Removal

Technique

uses

to Indicator Removal from Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Protocol or Service Impersonation

Technique

uses

to Query Registry

Technique

uses

Technique

uses

to Security Software Discovery

Technique

uses

to Standard Encoding

Technique

uses

to Steganography

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Management Instrumentation

Technique

6 external

References

mitre-attack

S0559

SUNBURST

—

Solorigate

—

FireEye SUNBURST Backdoor December 2020

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

Microsoft Deep Dive Solorigate January 2021

https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/

SolarWinds Sunburst Sunspot Update January 2021

https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/