Register for our upcoming webinar on electoral integrity! The 2024 Election Playbook with Maltego: Analysis, Challenges, and Solutions on Thursday, March 21, 2024 at 16:00 CET. Grab your spot now! close
08 Jun 2021

SolarWinds SUNBURST Compromise: Mapping Malicious Activity Using Farsight Historical DNS Data and Maltego

Roy Boetticher

There are many well-researched articles written about the SolarWinds compromise. However, given the skills demonstrated by malicious actors and suspicion regarding the attribution, the question remains: Have we uncovered all avenues that the attack might have taken place or are there instances and patterns that conventional methods cannot or may not yet uncover?

In short, the answer is no.

In this case study, focusing on the recent SolarWinds compromise, we will demonstrate how you can use the new DNSDB Flexible Search Transforms with Maltego to discover and uncover key assets and activities that might have been hidden during mainstream investigations using conventional tools and methods. Using historical passive DNS, we will show you how you can access recorded evidence of the past events – distant and recent – even if the DNS assets (domain names, IP addresses, etc.) have long disappeared from the internet or those that have been lawfully seized.

About SolarWinds SUNBURST Compromise 🔗︎

In December 2020, cyber threat analysis company FireEye discovered a global supply chain attack trojanizing SolarWinds Orion business software updates in order to distribute the malware named SUNBURST. The sophisticated attack affected public and private organizations—18,000 SolarWinds customers, including almost all Fortune 500 companies, government agencies, and government contractors—since as early as Spring 2020 and has resulted in network lateral movement and data theft by adversaries.

Investigating the SUNBURST Compromise 🔗︎

After being discovered, Microsoft has taken over the domain used by SUNBURST—avsvmcloud[.]com—and resolved it to 20.140.0[.]1. If SUNBURST now attempts to connect to its C2 coordinator using a subdomain of avsvmcloud[.]com, the kill-switch will be activated instead. Subsequently, without historical passive DNS data it is also no longer possible to investigate the hostnames generated with the DGA, the infected victims, the attack pattern observed, and the IP resolved from avsvmcloud[.]com’s subdomains.




About Farsight DNSDB Historical Passive DNS Data 🔗︎

Farsight Security DNSDB® is the world’s largest DNS intelligence database that provides a unique, fact-based, multifaceted view of the configuration of the global Internet infrastructure— with more than 100 billion domain resolution records and updated in real-time at over 200,000 times/second.

With Farsight Transforms in Maltego, users can expose entire networks, gain an outside-in view of their infrastructure and pivot across DNS record types. With Wildcard searches, expose hostnames/FQDNs, associated domains and further pivoting across IPs to expose all associated domains, FQDNs, IPs, MX, NX, and other record types.

Access to Farsight Data in Maltego 🔗︎

Farsight Transforms are available for both community and commercial Maltego users with a free trial. You can get started immediately without an API key or registration, or sign up to the 30-day free trial for more query allowance.

To access the full solution, a Maltego commercial license and a Farsight DNSDB subscription are required. Learn more about the access information on our Data Partner page here.

Case Study | Investigate and Evaluate the Scale of SolarWinds SUNBURST Attack 🔗︎

Using historical DNS data, investigators can still identify which subdomains were resolved to which IP addresses in relation to the SUNBURST attack. Furthermore, using Farsight’s Flexible Search Transforms in Maltego, analysts can retrieve not only specific domains and IP addresses, but also any domain matching a specific pattern.

In this case study, we demonstrate how to combine Maltego’s link analysis capability and Farsight DNSDB passive DNS historical data to retrieve the historical domain and IP address data and analyze the potential scope of the SUNBURST attack. Specifically, we will study C2 communications that occurred before Microsoft’s action and possibly also before the SolarWinds compromise was public knowledge.

Maltego Farsight Case Study Screenshot

Download and Read the Case Study Now 🔗︎

Download and read this case study now to learn how historical passive DNS observations can assist to uncover past, present and even future threats!

Maltego farsight joint webinar promotion image

Download and watch the live demo of the SolarWinds SUNBURST investigation and Farsight’s new Flexible Search Transforms and deep dive into the domain of historical passive DNS data!



Follow us on Twitter and LinkedIn or subscribe to our email newsletter for more whitepapers, case studies, and SOC tips like this!

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua and Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia Herzegovina +387
Botswana +267
Brazil +55
Brunei +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde Islands +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Côte d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus North +90392
Cyprus South +357
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea - Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea North +850
Korea South +82
Kuwait +965
Kyrgyzstan +996
Laos +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia +691
Moldova +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Islands +672
Northern Marianas +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russia +7
Rwanda +250
San Marino +378
Sao Tome & Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovak Republic +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
St. Helena +290
St. Kitts +1869
St. Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syria +963
Taiwan +886
Tajikstan +7
Thailand +66
Togo +228
Tonga +676
Trinidad & Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +7
Turkmenistan +993
Turks & Caicos Islands +1649
Tuvalu +688
Uganda +256
UK +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
USA +1
Uzbekistan +7
Vanuatu +678
Vatican City +379
Venezuela +58
Vietnam +84
Virgin Islands - British +84
Virgin Islands - US +84
Wallis & Futuna +681
Yemen +969
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.