Thursday, December 24, 2020

It has a name - Sunburst - and some initial victim lists



Updates to the Story

The evolving massive intrusion upon public and private networks in the US that was perpetrated in 2020 from March to December new has a name - Sunburst. I think it's an apt name, given the vector by which it graced our presences. I am uncertain who picks the names for these things. I'd like to think the honor goes to the discoverer, dubious or not (looking at you, FireEye). 

I've been following the story a little bit, and have seen quite a bit of  expert technical analysis on the malware. The media is both underreporting what is going on, and getting it wrong on the Russia attribution. In fact, something to the effect of "this doesn't look like Russia's MO" may or may not have been in an article I read or on a slide that I saw. The truth of the matter is that given the sophistication the actor used in gaining access that the same care will likely have been taken to hide who is behind it. Perhaps they'd go as far as to implicate another entity as well. 

Who was hit?

Source: https://www.bleepingcomputer.com/news/security/solarwinds-victims-revealed-after-cracking-the-sunburst-malware-dga/

We'll start with the list of Government agencies. 

  • U.S. Department of the Treasury
  • U.S. National Telecommunications and Information Administration (NTIA)
  • U.S. Department of State
  • The National Institutes of Health (NIH) (Part of the U.S. Department of Health)
  • U.S. Department of Homeland Security (DHS)
  • U.S. Department of Energy (DOE)
  • U.S. National Nuclear Security Administration (NNSA)
  • Some US states (Specific states are undisclosed)
If I hade to paint the US Government targets with a broad brush, I'd categorize them as economic, infrastructure, health, security and nuclear. 

And here is the list of domains decoded.

Decoded Internal NameOrganization
(possibly inaccurate)
Response Address FamilyCommandFirst Seen
mnh.rg-law.ac.ilCollege of Law and Business,
Israel
NetBiosHTTP Backdoor2020-05-26
ad001.mtk.loMediatekNetBiosHTTP Backdoor2020-08-26
Aeria NetBiosHTTP Backdoor2020-06-26
Ameri NetBiosHTTP Backdoor2020-08-02
ank.comAnkcom CommunicationsNetBiosHTTP Backdoor2020-06-06
azlcyy NetBiosHTTP Backdoor2020-08-07
banccentral.comBancCentral Financial
Services Corp.
NetBiosHTTP Backdoor2020-07-03
barrie.caCity of BarrieNetBiosHTTP Backdoor2020-05-13
BCC.l NetBiosHTTP Backdoor2020-08-22
bhq.lan NetBiosHTTP Backdoor2020-08-18
cds.capilanou.Capilano UniversityNetBiosHTTP Backdoor2020-08-27
Centr NetBiosHTTP Backdoor2020-06-24
chc.dom NetBiosHTTP Backdoor2020-08-04
christieclinic.Christie Clinic TelehealthNetBiosHTTP Backdoor2020-04-22
CIMBM NetBiosHTTP Backdoor2020-09-25
CIRCU NetBiosHTTP Backdoor2020-05-30
CONSO NetBiosHTTP Backdoor2020-06-17
corp.ptci.comPioneer Telephone
Scholarship Recipients
NetBiosHTTP Backdoor2020-06-19
corp.stingraydiStingray (Media and
entertainment)
NetBiosHTTP Backdoor2020-06-10
corp.stratusnetStratus NetworksNetBiosHTTP Backdoor2020-04-28
cosgroves.localCosgroves (Building services
consulting)
NetBiosHTTP Backdoor2020-08-25
COTESCotes (Humidity Management)NetBiosHTTP Backdoor2020-07-25
csnt.princegeorCity of Prince GeorgeNetBiosHTTP Backdoor2020-09-18
cys.localCYS Group (Marketing analytics)NetBiosHTTP Backdoor2020-07-10
digitalsense.coDigital Sense (Cloud Services)NetBiosHTTP Backdoor2020-06-24
ehtuh- NetBiosHTTP Backdoor2020-05-01
escap.org NetBiosHTTP Backdoor2020-07-10
f.gnam NetBiosHTTP Backdoor2020-04-04
fhc.local NetBiosHTTP Backdoor2020-07-06
fidelitycomm.loFidelity Communications (ISP)NetBiosHTTP Backdoor2020-06-02
fisherbartoninc.comThe Fisher Barton Group
(Blade Manufacturer)
NetBiosHTTP Backdoor2020-05-15
fmtn.adCity of FarmingtonNetBiosHTTP Backdoor2020-07-21
FWO.I NetBiosHTTP Backdoor2020-08-05
ggsg-us.ciscoCisco GGSGNetBiosHTTP Backdoor2020-06-24
ghsmain1.ggh.g NetBiosHTTP Backdoor2020-06-09
gxw NetBiosHTTP Backdoor2020-07-07
htwanmgmt.local NetBiosHTTP Backdoor2020-07-22
ieb.go.id NetBiosHTTP Backdoor2020-06-12
int.ncahs.net NetBiosHTTP Backdoor2020-09-23
internal.jtl.c NetBiosHTTP Backdoor2020-05-19
ironform.comIronform (metal fabrication)NetBiosHTTP Backdoor2020-06-19
isi NetBiosHTTP Backdoor2020-07-06
itps.uk.netInfection Prevention Society (IPS)NetBiosHTTP Backdoor2020-08-11
jxxyx. NetBiosHTTP Backdoor2020-06-26
kcpl.comKansas City Power and
Light Company
NetBiosHTTP Backdoor2020-07-07
keyano.localKeyano CollegeNetBiosHTTP Backdoor2020-06-03
khi0kl NetBiosHTTP Backdoor2020-08-26
lhc_2f NetBiosHTTP Backdoor2020-04-18
lufkintexas.netLufkin (City in Texas)NetBiosHTTP Backdoor2020-07-07
magnoliaisd.locMagnolia Independent
School District
NetBiosHTTP Backdoor2020-06-01
MOC.l NetBiosHTTP Backdoor2020-04-30
moncton.locCity of MonctonNetBiosHTTP Backdoor2020-08-25
mountsinai.hospMount Sinai HospitalNetBiosHTTP Backdoor2020-07-02
netdecisions.loNetdecisions (IT services)NetBiosHTTP Backdoor2020-10-04
newdirections.k NetBiosHTTP Backdoor2020-04-21
nswhealth.netNSW HealthNetBiosHTTP Backdoor2020-06-12
nzi_9p NetBiosHTTP Backdoor2020-08-04
city.kingston.on.caCity of Kingston,
Ontario, Canada
NetBiosHTTP Backdoor2020-06-15
dufferincounty.on.caDufferin County,
Ontario, Canada
NetBiosHTTP Backdoor2020-07-17
osb.local NetBiosHTTP Backdoor2020-04-28
oslerhc.orgWilliam Osler Health SystemNetBiosHTTP Backdoor2020-07-11
pageaz.govCity of PageNetBiosHTTP Backdoor2020-04-19
pcsco.comProfessional Computer SystemsNetBiosHTTP Backdoor2020-07-23
pkgix_ NetBiosHTTP Backdoor2020-07-15
pqcorp.comPQ CorporationNetBiosHTTP Backdoor2020-07-02
prod.hamilton.Hamilton CompanyNetBiosHTTP Backdoor2020-08-19
resprod.comRes Group (Renewable
energy company)
NetBiosHTTP Backdoor2020-05-06
RPM.l NetBiosHTTP Backdoor2020-05-28
sdch.localSouth Davis
Community Hospital
NetBiosHTTP Backdoor2020-05-18
servitia.intern NetBiosHTTP Backdoor2020-06-16
sfsi.stearnsbanStearns BankNetBiosHTTP Backdoor2020-08-02
signaturebank.lSignature BankNetBiosHTTP Backdoor2020-06-25
sm-group.localSM Group (Distribution)NetBiosHTTP Backdoor2020-07-07
te.nzTE Connectivity (Sensor
manufacturer)
NetBiosHTTP Backdoor2020-05-13
thx8xb NetBiosHTTP Backdoor2020-06-16
tx.org NetBiosHTTP Backdoor2020-07-15
usd373.orgNewton Public SchoolsNetBiosHTTP Backdoor2020-08-01
uzq NetBiosHTTP Backdoor2020-10-02
ville.terrebonnVille de TerrebonneNetBiosHTTP Backdoor2020-08-02
wrbaustralia.adW. R. Berkley Insurance AustraliaNetBiosHTTP Backdoor2020-07-11
ykz NetBiosHTTP Backdoor2020-07-11
2iqzth ImpLinkEnum processes2020-06-17
3if.2l3IF (Industrial Internet)ImpLinkEnum processes2020-08-20
airquality.orgSacramento Metropolitan
Air Quality Management District
ImpLinkEnum processes2020-08-09
ansc.gob.peGOB (Digital Platform of
the Peruvian State)
ImpLinkEnum processes2020-07-25
bcofsa.com.arBanco de FormosaImpLinkEnum processes2020-07-13
bi.corp ImpLinkEnum processes2020-12-14
bop.com.pkThe Bank of PunjabImpLinkEnum processes2020-09-18
camcity.local ImpLinkEnum processes2020-08-07
cow.local ImpLinkEnum processes2020-06-13
deniz.denizbankDenizBankImpLinkEnum processes2020-11-14
ies.comIES Communications
(Communications technology)
ImpLinkEnum processes2020-06-11
insead.orgINSEAD Business SchoolImpLinkEnum processes2020-11-07
KS.LO ImpLinkEnum processes2020-07-10
mixonhill.comMixon Hill (intelligent
transportation systems)
ImpLinkEnum processes2020-04-29
ni.corp.natins ImpLinkEnum processes2020-10-24
phabahamas.orgPublic Hospitals Authority,
Caribbean
ImpLinkEnum processes2020-11-05
rbe.sk.caRegina Public SchoolsImpLinkEnum processes2020-08-20
spsd.sk.caSaskatoon Public SchoolsImpLinkEnum processes2020-06-12
yorkton.cofyCommunity Options for
Families & Youth
ImpLinkEnum processes2020-05-08
.sutmf IpxUpdate config2020-06-25
atg.local No MatchUnknown2020-05-11
bisco.intBisco International
(Adhesives and tapes)
No MatchUnknown2020-04-30
ccscurriculum.c No MatchUnknown2020-04-18
e-idsolutions.IDSolutions (video conferencing)No MatchUnknown2020-07-16
ETC1. No MatchUnknown2020-08-01
gk5 No MatchUnknown2020-07-09
grupobazar.loca No MatchUnknown2020-06-07
internal.hws.o No MatchUnknown2020-05-23
n2k No MatchUnknown2020-07-12
publiser.it No MatchUnknown2020-07-05
us.deloitte.coDeloitteNo MatchUnknown2020-07-08
ush.com No MatchUnknown2020-06-15
xijtt- No MatchUnknown2020-07-21
xnet.kzX NET (IT provider in Kazakhstan)No MatchUnknown2020-06-09
zu0 No MatchUnknown2020-08-13
staff.technion.ac.il N/AN/AN/A
digitalreachinc.com N/AN/AN/A
orient-express.com N/AN/AN/A
tr.technion.ac.il N/AN/AN/A
lasers.state.la.us N/AN/AN/A
ABLE. N/AN/AN/A
abmuh_ N/AN/AN/A
acmedctr.ad N/AN/AN/A
ad.azarthritis.com N/AN/AN/A
ad.library.ucla.edu N/AN/AN/A
ad.optimizely. N/AN/AN/A
admin.callidusc N/AN/AN/A
aerioncorp.com N/AN/AN/A
agloan.ads N/AN/AN/A
ah.org N/AN/AN/A
AHCCC N/AN/AN/A
allegronet.co. N/AN/AN/A
alm.brand.dk N/AN/AN/A
amalfi.local N/AN/AN/A
americas.phoeni N/AN/AN/A
amr.corp.intel N/AN/AN/A
apu.mn N/AN/AN/A
ARYZT N/AN/AN/A
b9f9hq N/AN/AN/A
BE.AJ N/AN/AN/A
belkin.com N/AN/AN/A
bk.local N/AN/AN/A
bmrn.com N/AN/AN/A
bok.com N/AN/AN/A
btb.az N/AN/AN/A
c4e-internal.c N/AN/AN/A
calsb.org N/AN/AN/A
casino.prv N/AN/AN/A
cda.corp N/AN/AN/A
central.pima.g N/AN/AN/A
cfsi.local N/AN/AN/A
ch.local N/AN/AN/A
ci.dublin.ca. N/AN/AN/A
cisco.com N/AN/AN/A
corp.dvd.com N/AN/AN/A
corp.sana.com N/AN/AN/A
Count N/AN/AN/A
COWI. N/AN/AN/A
coxnet.cox.com N/AN/AN/A
CRIHB N/AN/AN/A
cs.haystax.loc N/AN/AN/A
csa.local N/AN/AN/A
csci-va.com N/AN/AN/A
csqsxh N/AN/AN/A
DCCAT N/AN/AN/A
deltads.ent N/AN/AN/A
detmir-group.r N/AN/AN/A
dhhs- N/AN/AN/A
dmv.state.nv. N/AN/AN/A
dotcomm.org N/AN/AN/A
DPCIT N/AN/AN/A
dskb2x N/AN/AN/A
e9.2pz N/AN/AN/A
ebe.co.roanoke.va.us N/AN/AN/A
ecobank.group N/AN/AN/A
ecocorp.local N/AN/AN/A
epl.com N/AN/AN/A
fremont.lamrc. N/AN/AN/A
FSAR. N/AN/AN/A
ftfcu.corp N/AN/AN/A
gksm.local N/AN/AN/A
gloucesterva.ne N/AN/AN/A
glu.com N/AN/AN/A
gnb.local N/AN/AN/A
gncu.local N/AN/AN/A
gsf.cc N/AN/AN/A
gyldendal.local N/AN/AN/A
helixwater.org N/AN/AN/A
hgvc.com N/AN/AN/A
ia.com N/AN/AN/A
inf.dc.net N/AN/AN/A
ingo.kg N/AN/AN/A
innout.corp N/AN/AN/A
int.lukoil-international.uz N/AN/AN/A
intensive.int N/AN/AN/A
ions.com N/AN/AN/A
its.iastate.ed N/AN/AN/A
jarvis.lab N/AN/AN/A
-jlowd N/AN/AN/A
jn05n8 N/AN/AN/A
jxb3eh N/AN/AN/A
k.com N/AN/AN/A
LABEL N/AN/AN/A
milledgeville.l N/AN/AN/A
nacr.com N/AN/AN/A
ncpa.loc N/AN/AN/A
neophotonics.co N/AN/AN/A
net.vestfor.dk N/AN/AN/A
nih.if N/AN/AN/A
nvidia.com N/AN/AN/A
on-pot N/AN/AN/A
ou0yoy N/AN/AN/A
paloverde.local N/AN/AN/A
pl8uw0 N/AN/AN/A
q9owtt N/AN/AN/A
rai.com N/AN/AN/A
rccf.ru N/AN/AN/A
repsrv.com N/AN/AN/A
ripta.com N/AN/AN/A
roymerlin.com N/AN/AN/A
rs.local N/AN/AN/A
rst.atlantis-pak.ru N/AN/AN/A
sbywx3 N/AN/AN/A
sc.pima.gov N/AN/AN/A
scif.com N/AN/AN/A
SCMRI N/AN/AN/A
scroot.com N/AN/AN/A
seattle.interna N/AN/AN/A
securview.local N/AN/AN/A
SFBAL N/AN/AN/A
SF-Li N/AN/AN/A
siskiyous.edu N/AN/AN/A
sjhsagov.org N/AN/AN/A
Smart N/AN/AN/A
smes.org N/AN/AN/A
sos-ad.state.nv.us N/AN/AN/A
sro.vestfor.dk N/AN/AN/A
superior.local N/AN/AN/A
swd.local N/AN/AN/A
ta.org N/AN/AN/A
taylorfarms.com N/AN/AN/A
thajxq N/AN/AN/A
thoughtspot.int N/AN/AN/A
tsyahr N/AN/AN/A
tv2.local N/AN/AN/A
uis.kent.edu N/AN/AN/A
uncity.dk N/AN/AN/A
uont.com N/AN/AN/A
viam-invenient N/AN/AN/A
vms.ad.varian.com N/AN/AN/A
vsp.com N/AN/AN/A
WASHO N/AN/AN/A
weioffice.com N/AN/AN/A
wfhf1.hewlett. N/AN/AN/A
woodruff-sawyer N/AN/AN/A
HQ.RE-wwgi2xnl N/AN/AN/A
xdxinc.net N/AN/AN/A
y9k.in N/AN/AN/A
zeb.i8 N/AN/AN/A
zippertubing.co N/AN/AN/A


This is still a developing story. 


No comments:

Post a Comment

Through A Procedurally Generated Galaxy - Tau Ceti

 After a several orbits of Proxima Centauri B, it was time to start testing out the FTL drives properly. I consulted the galaxy map and deci...