H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SUNSPOT](https://attack.mitre.org/software/S0562) is an implant that injected the [SUNBURST](https://attack.mitre.org/software/S0559) backdoor into the SolarWinds Orion software update framework. It was used by [APT29](https://attack.mitre.org/groups/G0016) since at least February 2020.(Citation: CrowdStrike SUNSPOT Implant January 2021)

Labels

malware

14 recorded

Relationships

uses

from APT29

Group

uses

from SolarWinds Compromise

Campaign

uses

to Access Token Manipulation

Technique

uses

to Compromise Software Supply Chain

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mutual Exclusion

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Stored Data Manipulation

Technique

3 external

References

mitre-attack

S0562

SUNSPOT

—

CrowdStrike SUNSPOT Implant January 2021

https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/