{"id":122675,"date":"2020-12-17T18:03:16","date_gmt":"2020-12-18T02:03:16","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=122675"},"modified":"2020-12-22T10:58:38","modified_gmt":"2020-12-22T18:58:38","slug":"solarwinds-statement-solarstorm","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2020\/12\/solarwinds-statement-solarstorm\/","title":{"rendered":"Palo Alto Networks Rapid Response: Navigating the SolarStorm Attack"},"content":{"rendered":"

Since learning of the <\/span>SolarWinds supply chain attack<\/span><\/a> last weekend, security teams everywhere have been scrambling to determine whether they were compromised by the \u201cSolarStorm\u201d attacks. Every few hours a new compromised entity is identified.\u00a0<\/span><\/p>\n

They\u2019re right to pay attention. We will soon be talking about this as one of the most serious cyberattacks in history. Tainted updates to SolarWinds Orion software were distributed for months before they were identified, positioning attackers to obtain administrative privileges and establish long-term network access \u2013 potential for a complete compromise of an organization by malicious actors. We must come together to defend against an attack of this magnitude.\u00a0<\/span><\/p>\n

In an effort to help the broader community, I\u2019d like to share our experience successfully preventing a SolarStorm attack.\u00a0<\/span><\/p>\n

Recently, we experienced an attempt to download Cobalt Strike on one of our IT SolarWinds servers. Cortex XDR instantly blocked the attempt with our Behavioral Threat Protection capability and our SOC isolated the server, investigated the incident and secured our infrastructure. We also deployed a set of IOCs to our customer-facing Palo Alto Networks products as a result of this.\u00a0<\/span><\/i><\/p>\n

We thought this was an isolated incident, however, on Dec. 13, we became aware that the SolarWinds software supply chain was compromised and it became clear that the incident we prevented was an attempted SolarStorm attack. Given this new information, we analyzed our entire infrastructure extensively one more time. The magnitude of the SolarStorm attack requires us to continuously evaluate our infrastructure, but we remain confident that Palo Alto Networks continues to be secure.\u00a0<\/span><\/p>\n

It is our top priority to protect our customers from these attacks leveraging our experience, industry intelligence, products and services. To help our customers, we have set aside expert resources to support two distinct programs:\u00a0<\/span><\/p>\n