Microsoft blocks customer access to malicious SolarWinds binaries

The firm has moved to quarantine potential threats as reports emerge of the role of Microsoft 365 in the devastating breach

Microsoft is quarantining certain compromised SolarWinds binaries related to the Orion Platform in its security products following the revelation of the devastating supply chain cyber attack by state-backed hackers

The Orion Platform binaries can be used by cyber criminals to remotely access corporate devices, Microsoft explained in a blog post, leaving them susceptible to the attack it has dubbed 'Solorigate'. 

The firm has, as a result, started blocking the known SolarWinds binaries in its Microsoft Defender Antivirus platform. This will quarantine the binary even if the process is running, which may cause complications for customers running the SolarWinds platform as it’s a server product.

The firm had previously releasing detections alerting users to the presence of these binaries, with the recommendation to isolate and investigate the devices in question. It seems these measures, however, aren’t strong enough relative to the scale and severity of the threat.

Compromised versions of SolarWinds Orion released between March and June 2020 contained the strain of malware that Microsoft has dubbed Solorigate, leading to the infiltration of thousands of organisations. 

FireEye was the first company that detected it had been compromised by state-backed hackers, and only after closer examination did the company find the hackers had a backdoor into SolarWinds. It has since emerged that at least 18,000 SolarWinds customers have been potentially compromised as part of the attack, including massive corporations and US government agencies.

The move comes as a Securities and Exchange Commission (SEC) filing revealed that the Microsoft Office 365 accounts of SolarWinds employees were broken into. The firm suggested, according to this filing, that it was aware of an attack vector used to compromise the company’s emails, with this intrusion also granting attackers access to other data contained in its Microsoft-developed productivity suite.

While Microsoft’s role in the attack may now fall under some scrutiny, this particular compromise warrants further investigation and it’s not yet conclusive as to whether the breach played a role on the attack on the Orion platform. 

A coalition of tech companies including Microsoft, meanwhile, has acted to seize a domain that played a key part in the original cyber attack, according to ZDNet.

The group seized the domain serving as the command and control server for the Solorigate malware distributed to the compromised targes swept up in the hack. This has been described as “protective work” to prevent the attackers from delivering new orders to infected systems.

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Researchers disclose top flaws abused by ransomware gangs
ransomware

Researchers disclose top flaws abused by ransomware gangs

20 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021
How do hackers choose their targets?
hacking

How do hackers choose their targets?

17 Sep 2021
Owner of DDoS for hire sites found guilty of hacking offences
distributed denial of service (DDOS)

Owner of DDoS for hire sites found guilty of hacking offences

17 Sep 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021
Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition
mergers and acquisitions

Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition

14 Sep 2021