SolarWinds is a software company whose products are used by organisations to monitor and manage IT infrastructure. One of its key products the Orion platform (which was named the SolarWinds Platform in 2022), provided organisations with tools for monitoring networked systems and infrastructure. The importance of Orion made it an attractive target for attackers. The SolarWinds supply-chain attack of 2020 demonstrated that one of the greatest cybersecurity risks may come through a source that organisations already trust, i.e. their software suppliers. Rather than directly attacking each victim organisation, the attackers compromised SolarWinds software development and distribution process by inserting malicious code into legitimate updates of its Orion network-management platform and installing the affected updates meant their customers were consequently exposing their organizations environments to the attackers.
Modern organisations are increasingly dependent on third-party software, cloud services, open-source components and technology providers and as these dependencies increase, so does the potential impact of a compromised supplier. This incident exposed a fundamental weakness in conventional cybersecurity thinking; organisations cannot assume that software is secure simply because it originates from a trusted vendor.
According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), attackers compromised SolarWinds Orion software and distributed malicious code through legitimate software updates. CISA identified affected Orion versions ranging from 2019.4 HF 5 through 2020.2.1 HF 1, which had been released between March and June 2020.
The malicious component became known as SUNBURST.
The significance of SUNBURST was that it was not distributed as an obviously malicious application, instead it was embedded within legitimate SolarWinds software. The compromised organisations were following normal IT practices by downloading and installing these updates because it was a genuine update from a trusted supplier.
Microsoft’s analysis of the incident described the compromised Orion DLL as the initial mechanism through which attackers established access to affected environments. The attackers could then selectively pursue organisations rather than immediately revealing themselves across every affected system.
A conventional cyber attack may follow a relatively straightforward pattern; an attacker directly compromises a vulnerable organisation using different methods such as phishing, ddos, credential surfing etc. This supply chain attack used a slightly different approach by breaching a trusted supplier/ software to gain access to the target organisations environment. This distinction is important because modern organisations rarely operate in isolation. They depend on numerous third parties for software, infrastructure, cloud services, security tools and other digital capabilities.
NIST has identified software supply-chain security as a critical cybersecurity issue because organisations increasingly depend on technology products and services that are developed, integrated and maintained outside their direct control. The most important feature of the SolarWinds attack was not simply the malware itself. It was the trust relationship between SolarWinds and its customers.
Organisations generally expect software updates from established vendors to be legitimate. Updates are necessary for security, performance and functionality, meaning that refusing software updates altogether is not a realistic security strategy.
The attackers exploited precisely this relationship.
The SolarWinds incident also raises a broader question about traditional cybersecurity architecture. Over the years in cybersecurity, considerable emphasis has been placed on protecting a defined network perimeter. The assumption was that trusted activity occurred inside the perimeter while malicious activity originated outside it. But modern organisations and digital environments do not have such clear boundaries. Employees work remotely, organisations use cloud platforms, applications communicate through APIs, software is supplied by third parties, open-source libraries are incorporated into commercial products, and even managed service providers have privileged access to customer environments. As a result, the modern attack surface extends beyond the organisation itself. Organisations now must not only consider how secure their organisation is but also the security of the stakeholders which their systems and people depend on.
SolarWinds demonstrated that securing the software supply chain requires controls throughout the software development lifecycle. This attack poses a serious question; How can an organisation guarantee the security of software when it cannot directly control the environment in which that software is developed?
Software integrity verification mechanisms that help verify that software has not been unexpectedly modified during development, compilation or distribution can be implemented but it cannot by itself guarantee 100% the integrity of software before it enters the environment. Digital signatures are valuable, but this incident demonstrates that simply knowing that software was signed by a legitimate vendor does not necessarily prove that the software itself is free from malicious modifications.
A Software Bill of Materials (SBOM) provides information about the components contained within software. SBOMs can improve visibility into software dependencies and help organisations identify potentially vulnerable components.
However, SBOMs like the others should not be regarded as a complete solution. They provide visibility, but organisations still need controls to protect the software development and build processes that produce the final software. Organisations must monitor the behaviour of applications after deployment. This is particularly important because supply-chain compromises may involve software that appears legitimate during installation but behaves abnormally after deployment.
The SolarWinds incident raises an uncomfortable question; can organisations ever eliminate supply-chain risk?
The answer is probably no. Modern organisations are too dependent on interconnected technology ecosystems to eliminate third-party dependencies entirely. Attempting to remove all external software and suppliers would be impractical and could create other operational risks. The more realistic objective is therefore risk reduction and resilience.
Organisations should assume that at some point a trusted supplier could be compromised and therefore security architecture should limit what an attacker can do when a compromise occurs. This means moving from a prevention only mindset towards a combination of prevention, detection, containment and recovery. This is perhaps the most important lesson from SolarWinds. A mature cybersecurity strategy should only not ask “How do we stop the breach?”. It should also ask “If a trusted supplier is compromised tomorrow, how quickly can we detect it, contain it and recover?”. That shift in thinking is essential because no security control is perfect.
In a connected digital economy trust is necessary, but trust without verification and continuous monitoring can become an attack vector.
References
Cybersecurity and Infrastructure Security Agency, “Active Exploitation of SolarWinds Software,” Alert, Dec. 13, 2020. [Online]. Available: CISA — Active Exploitation of SolarWinds Software
CISA, “CISA Releases CISA Insights and Creates Webpage on Ongoing APT Cyber Activity,” Dec. 23, 2020. [Online]. Available: CISA — Ongoing APT Cyber Activity
M. A. Scholl, “SolarWinds and Beyond: Improving the Cybersecurity of Software Supply Chains,” National Institute of Standards and Technology, May 25, 2021. [Online]. Available: NIST — SolarWinds and Beyond
Microsoft, “Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack,” Microsoft Security, Dec. 18, 2020. [Online]. Available: Microsoft Security — Analyzing Solorigate
J. Martínez and J. M. Durán, “Software Supply Chain Attacks, a Threat to Global Cybersecurity: SolarWinds’ Case Study,” International Journal of Safety and Security Engineering, vol. 11, no. 5, pp. 537–545, 2021, doi: 10.18280/ijsse.110505. [Online]. Available: Publisher article
CISA, “CISA Releases CISA Insights and Creates Webpage on Ongoing APT Cyber Activity,” Dec. 23, 2020. [Online]. Available: CISA Alert
“An Empirical Study on Reproducible Packaging in Open-Source Ecosystems,” in Proc. IEEE/ACM International Conference on Software Engineering, 2025, doi: 10.1109/ICSE55347.2025.00136.
U.S. Securities and Exchange Commission, “SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures,” Press Release 2023-227, Oct. 30, 2023. [Online]. Available: SEC — SolarWinds enforcement action
CISA Software Bill of Materials
https://www.cisa.gov/topics/information-communications-technology-supply-chain-security/sbom
