FireEye finds new malware likely linked to SolarWinds hackers

FireEye discovered a new "sophisticated second-stage backdoor" on the servers of an organization compromised by the threat actors behind the SolarWinds supply-chain attack.

The new malware is dubbed Sunshuttle, and it was "uploaded by a U.S.-based entity to a public malware repository in August 2020."

FireEye researchers Lindsay Smith, Jonathan Leathery, and Ben Read believe Sunshuttle is linked to the threat actor behind the SolarWinds supply-chain attack.

"Mandiant observed SUNSHUTTLE at a victim compromised by UNC2452, and have indications that it is linked to UNC2542, but we have not fully verified this connection," FireEye said.

Sunshuttle is GO-based malware featuring detection evasion capabilities. At the moment, the infection vector used to install the backdoors is not yet known, but it is "most likely" dropped as a second-stage backdoor.

"The new SUNSHUTTLE backdoor is a sophisticated second-stage backdoor that demonstrates straightforward but elegant detection evasion techniques via its "blend-in" traffic capabilities for C2 communications," FireEye added.

"SUNSHUTTLE would function as a second-stage backdoor in such a compromise for conducting network reconnaissance alongside other SUNBURST-related tools."

New blog from @jonleathery and @LindsaySmithDC on SUNSHUTTLE, a full featured backdoor written in Go, that we think is linked to UNC2452. Tracking this is a team effort with our IR, FLARE and AP teams doing great work.https://t.co/dr7DwHRh71

— Ben Read (@bread08) March 4, 2021

Fifth malware linked to SolarWinds hackers

If the connection made by FireEye with the state hackers behind the SolarWinds hack checks out, Sunshuttle would be the fourth malware found while investigating the supply-chain attack.

The threat actor who orchestrated the attacks is currently tracked as UNC2452 (FireEye), StellarParticle (CrowdStrike), SolarStorm (Palo Alto Unit 42), and Dark Halo (Volexity).

CrowdStrike found the Sunspot malware used to inject backdoors in Orion platform builds after being dropped by in the development environment of SolarWinds' Orion IT management software.

The Sunburst (Solorigate) backdoor malware was deployed during second-stage attacks on the systems of organizations using trojanized Orion builds via the platform's built-in automatic update mechanism.

FireEye found a third malware named Teardrop, a previously unknown memory-only dropper and a post-exploitation tool the attackers used to deploy customized Cobalt Strike beacons.

A fourth malware, Symantec found Raindrop, a malware similar to Teardrop used by the SolarWinds hackers to deliver Cobalt Strike beacons during post-exploitation.

While investigating the supply-chain attack, Palo Alto Networks Unit 42 and Microsoft discovered SuperNova, a malware strain not linked to UNC2452 but also delivered using trojanized Orion builds.