• About
  • Subscribe
  • Contact
Wednesday, May 7, 2025
    Login
  • Management Leadership
    • Growth Strategies
    • Finance
    • Operations
    • Sales and Marketing
    • Careers
  • Technology
    • Infrastructure and Platforms
    • Business Applications and Databases
    • Big Data, Analytics and Intelligence
    • Security
  • Industry Verticals
    • Finance and Insurance
    • Manufacturing
    • Logistics and Transportation
    • Retail and Wholesale
    • Hospitality and Tourism
    • Government and Public Services
    • Utilities
    • Media and Telecommunications
  • Resources
    • Whitepapers
    • PodChats
    • Videos
  • Events
No Result
View All Result
  • Management Leadership
    • Growth Strategies
    • Finance
    • Operations
    • Sales and Marketing
    • Careers
  • Technology
    • Infrastructure and Platforms
    • Business Applications and Databases
    • Big Data, Analytics and Intelligence
    • Security
  • Industry Verticals
    • Finance and Insurance
    • Manufacturing
    • Logistics and Transportation
    • Retail and Wholesale
    • Hospitality and Tourism
    • Government and Public Services
    • Utilities
    • Media and Telecommunications
  • Resources
    • Whitepapers
    • PodChats
    • Videos
  • Events
No Result
View All Result
No Result
View All Result
Home Technology Security

Security experts link SolarWinds attack with Kazuar backdoor

FutureCIO Editors by FutureCIO Editors
January 14, 2021
Photo by Anete Lusina from Pexels

Photo by Anete Lusina from Pexels

SANS Emergency Webcast:  What you need to know about the SolarWinds Supply-Chain Attack

On December 13, 2020, FireEye, Microsoft and SolarWinds made public the discovery of a large, sophisticated supply chain attack that deployed a new, previously unknown malware “Sunburst” used against SolarWinds’ Orion IT customers.

Kaspersky’s experts found various specific code similarities between Sunburst and known versions of Kazuar backdoors – the type of malware that provides remote access to a victim’s machine. The new findings provide insights that can help the researchers move forward in the investigation of the attack.

While studying the Sunburst backdoor Kaspersky’s experts discovered several features that overlap with a previously identified Kazuar, a backdoor written using the .NET framework first reported by Palo Alto in 2017 and used in the cyberespionage attacks across the globe. Multiple similarities in code suggest a connection between Kazuar and Sunburst, albeit of undetermined nature.

The overlapped features between Sunburst and Kazuar include the victim UID generation algorithm, the sleeping algorithm and the extensive usage of the FNV-1a hash. According to the experts, these code fragments are not 100% identical, suggesting Kazuar and Sunburst may be related, though the nature of this relation is still not entirely clear.

After the Sunburst malware was first deployed, in February 2020, Kazuar continued to evolve and later 2020 variants are even more similar in some respect to Sunburst.

Overall, during the years of Kazuar evolution, the experts observed a continuous development, in which significant features which bear resemblance to Sunburst, were added. While these similarities between Kazuar and Sunburst are notable, there could be a lot of reasons for their existence, including Sunburst being developed by the same group as Kazuar, Sunburst developers using Kazuar as an inspiration point, the move of one of Kazuar developers to the Sunburst team, or both groups behind Sunburst and Kazuar having obtained their malware from the same source.

“The identified connection does not give away who was behind the SolarWinds attack, however, it provides more insights that can help the researchers move forward in this investigation. We believe it’s important that other researchers around the world investigate these similarities and attempt to discover more facts about Kazuar and the origin of Sunburst, the malware used in the SolarWinds breach. Judging from past experience, for instance, looking back to the WannaCry attack, in the early days, there were very few facts linking them to the Lazarus group. In time, more evidence appeared and allowed us, and others, to link them together with high confidence. Further research on this topic is crucial for connecting the dots,” commented Costin Raiu, director of Kaspersky’s Global Research and Analysis Team.

Yaniv Balmas, head of Cyber Research at Check Point Software Technologies, added that: “We can confirm the findings found by Kaspersky and came to similar conclusions. Kaspersky correctly stated that there are multiple explanations for such similarity and that the code overlap by itself cannot be enough for an absolute attribution of SUNBURST to the Kazuar operators.

“That said, the most likely possibility is that the authors of Kazuar have a part in the development of SUNBURST, especially because new variants of Kazuar that were written after SUNBURST, have unique pieces of code that can be found in SUNBURST itself.”

Kaspersky recommendation:

  • Provide your SOC team with access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal grants access to the company’s TI, providing cyberattack data and insights gathered by Kaspersky for more than 20 years. Free access to its curated features that allow users to check files, URLs and IP addresses is available here.
  • Organizations that would like to conduct their own investigations will benefit from Kaspersky Threat Attribution Engine. It matches discovered malicious code against malware databases, and, based on the code similarities, attributes it to previously revealed APT campaigns.
Related:  Concerns arise as AI-generated code comes with security risks
Tags: Check Point Software TechnologiesKasperskyKazuar BackdoorSolarwinds OrionSUnburst
FutureCIO Editors

FutureCIO Editors

No Result
View All Result

Recent Posts

  • Agentic AI-powered AppSec platform launched for the AI era
  • IDC forecasts GenAI alone will grow at a 59.2% CAGR
  • Dataiku brings new AI capabilities to create and control AI agents
  • Microsoft reveals the rise of a new kind of organisation in the AI era
  • St Luke’s ElderCare enhances data security and user experience with Juniper

Live Poll

Categories

  • Big Data, Analytics & Intelligence
  • Business Applications & Databases
  • Business-IT Alignment
  • Careers
  • Case Studies
  • CISO
  • CISO strategies
  • Cloud, Virtualization, Operating Environments and Middleware
  • Computer, Storage, Networks, Connectivity
  • Corporate Social Responsibility
  • Customer Experience / Engagement
  • Cyber risk management
  • Cyberattacks and data breaches
  • Cybersecurity careers
  • Cybersecurity operations
  • Education
  • Education
  • Finance
  • Finance & Insurance
  • FutureCISO
  • General
  • Governance, Risk and Compliance
  • Government and Public Services
  • Growth Strategies
  • Hospitality & Tourism
  • HR, education and Training
  • Industry Verticals
  • Infrastructure & Platforms
  • Insider threats
  • Latest Stories
  • Logistics & Transportation
  • Management Leadership
  • Manufacturing
  • Media and Telecommunications
  • News Stories
  • Operations
  • Opinion
  • Opinions
  • People
  • Process
  • Remote work
  • Retail & Wholesale
  • Sales & Marketing
  • Security
  • Tactics and Strategies
  • Technology
  • Utilities
  • Videos
  • Vulnerabilities and threats
  • White Papers

Strategic Insights for Chief Information Officers

FutureCIO is about enabling the CIO, his team, the leadership and the enterprise through shared expertise, know-how and experience - through a community of shared interests and goals. It is also about discovering unknown best practices that will help realize new business models.

Quick Links

  • Videos
  • Resources
  • Subscribe
  • Contact

Cxociety Media Brands

  • FutureIoT
  • FutureCFO
  • FutureCIO

Categories

  • Privacy Policy
  • Terms of Use
  • Cookie Policy

Copyright © 2022 Cxociety Pte Ltd | Designed by Pixl

Login to your account below

or

Not a member yet? Register here

Forgotten Password?

Fill the forms bellow to register

All fields are required. Log In

Retrieve your password

Please enter your username or email address to reset your password.

Log In
No Result
View All Result
  • Management Leadership
    • Growth Strategies
    • Finance
    • Operations
    • Sales and Marketing
    • Careers
  • Technology
    • Infrastructure and Platforms
    • Business Applications and Databases
    • Big Data, Analytics and Intelligence
    • Security
  • Industry Verticals
    • Finance and Insurance
    • Manufacturing
    • Logistics and Transportation
    • Retail and Wholesale
    • Hospitality and Tourism
    • Government and Public Services
    • Utilities
    • Media and Telecommunications
  • Resources
    • Whitepapers
    • PodChats
    • Videos
  • Events
Login

Copyright © 2022 Cxociety Pte Ltd | Designed by Pixl

Subscribe