SUNBURST & Memory Analysis

Fri, 25 Dec 2020 00:00:00 +0000

The recent SolarWind’s hack which resulted in a backdoor version of their SolarWind Orion product which counts 33,000 customers has been all over the news in the past few weeks - most things have been said and repeated, although there are few notes that I mentioned on Twitter which I would like to compile in a blogpost for perenniality.

First of all, I would like to point out to the presence in the backdoor process blacklist (the full list can be found on Itay Cohen’s repository) of several processes that can be used for either:

Dfir on Matt Suiche

SUNBURST & Memory Analysis