SolarWinds Attackers

Profile narrative

The threat actor known publicly as the SolarWinds Attackers operates under that alias and has been linked to activities originating from the United States of America. Observed targeting focuses on corporate backup servers and associated critical infrastructure, with reported effects on a small Dutch company and potential disruptions to European manufacturing sectors. The actor’s strategic objective in the documented incident appears to be financial gain through the deployment of ransomware, as the malicious update was designed to encrypt data before executing standard ransomware operations.

In the March 6 2021 campaign, the actor compromised a backup software vendor’s update mechanism, inserting the BlockKopieren ransomware payload into a legitimate software update. This supply‑chain approach served as the initial access vector, allowing the ransomware to reach backup servers where it encrypted data prior to the typical ransomware execution phase. The tooling style demonstrated a focus on leveraging trusted update channels to bypass defenses, and the malware family employed was specifically identified as BlockKopieren. No additional malware families or distinct tooling patterns are described in the available source material.

Attribution of this incident remains uncertain; while the vendor traced the compromise to a prior breach of its corporate design system that occurred during the broader SolarWinds incident, investigators have indicated that exploitation of known vulnerabilities could explain the activity rather than direct involvement by the original SolarWinds actors. No public evidence establishes a state nexus or criminal consortium affiliation for the SolarWinds Attackers in this case. The 2021‑03‑06 backup software compromise serves as the sole representative operation documented in the provided context.

Incidents

Attributed incidents are available to members.