--- title: "The Solarigate (SUNBURST) Killer: Stopping SolarWinds C2" description: "Why the SolarWinds Orion backdoor could not reach stage two on networks where adam:ONE refuses connections to destinations that were never vetted." url: https://adamnet.works/videos/solarigate-sunburst-killer/ index: https://adamnet.works/llms.txt --- [All videos](https://adamnet.works/videos.md) Supply Chain Attack · Command and Control · DTTS # The Solarigate (SUNBURST) Killer David Redekop explains why a multi-stage attack such as the SolarWinds Orion backdoor cannot reach stage two on a network where adam:ONE refuses connections to destinations that have not been vetted. January 6, 2021 • 11 min ![The Solarigate (SUNBURST) Killer](https://adamnet.works/assets/thumbs/yt-egIEqExPURE.webp) The SolarWinds Orion compromise delivered signed malware to about 18,000 organizations through a trusted software update that no customer could have stopped. In this video David Redekop argues that every multi-stage command-and-control attack must eventually connect out. A network where adam:ONE® refuses connections to destinations that have not been vetted traps the dropper before stage two and gives defenders time to find it. The protection does not depend on knowing the attacker’s domain names in advance. As David puts it, “we don’t know that we know all of those domain names yet.” The demonstration shows connections to two of the attack’s domains being refused. The [Orion SolarWinds breach case study](https://adamnet.works/case-studies/solarwinds-solarigate-supply-chain-attack.md) summarizes the attack, who it affected and what the adam:ONE logs showed once the threat became public. ## Full Transcript **Francois Driessen:** So I’m here with David in the studio for ADAM, and you might have heard a little bit about the Orion SolarWinds. Have been in the news for a while, and we thought it’d be a good idea just to do a bit of a quick deep dive. It will actually be a fast deep dive. Okay, see how quick we can do this, because this is actually very, very interesting and a very, very good case to look at. But David, let’s talk a little bit about SolarWinds. What actually just took place here? **David Redekop:** Yeah. SolarWinds is a company that offers services to Fortune 500s, governments around the world, that offers them a central way to manage all kinds of devices. So it’s like the heartbeat of a nervous system, is effectively what the SolarWinds Orion product is. And what happened was that some attackers realized the sweetness of that little honeypot, as it were. Not a real play honeypot, but a real-life honeypot: that if they could somehow get into that system, then via that nervous system they could reach far and wide. And so that’s what the attackers did. They found a way to get their own source code into the real published source code, so that as people updated their Orion software, along with it came a signed bit of malware code. **David Redekop:** And that’s how 18,000-plus locations that did get the update did actually get that information. **Francois Driessen:** And there’s a lot of guys, these aren’t just small little dinky players, right? These are Fortune 500 companies. So we’re talking about guys with proper security. Just look at this list. Some of the named people affected by this, these are not small little beginner players. Just look at this list that ZDNet put in there in their article here. So of course FireEye, which was the first to come out with us. U.S. Treasury Department, and that’s huge. U.S. Department of Commerce, National Telecom, Department of National Health, National Institutes. CISA was hit by it. The DHS was hit by the, that’s Homeland Security, that’s huge. And of course the U.S. Department of State, right? So these aren’t just beginner guys. So David, how does something like this actually happen today still, right? What was the method? What actually went on here? **David Redekop:** Well, the method is possible, first of all, it’s made possible because we still are not thinking proactively secure as a society. We still think proactively as “let’s get something to work.” And so the attackers just had to say, “Okay, so if we put some effort into writing some code that’s malicious, how do we get widest spread possible?” Well, the widest spread possible would, if we can get into many organizations from the inside, right? Of course I’m speculating now, but obviously this is the thought process that went on in the attacker’s mind. And if they don’t have a moral compass by which to guide them, that they’re going to put their effort into something that will be about stealing from someone, then what’s to keep them from taking a path that says, “Oh well, one of the tools that’s commonly used amongst businesses of all sizes is the central nervous system, this product called Orion”? Because when Orion gets installed in a network, the network administrators give it usernames and passwords and device names. Routers, switches, gateways, everything gets into this one central place. And so that’s how it made sense that they get into that system, because then with one extraction they can now exfiltrate all these credentials and a large amount of inside network information that someone would need in order to do a very quiet, a very stealthy recon of an inside network. Once they have that information, then they can do a way more stealthy network attack that isn’t a wide spray approach, where the more they spray, the more they do, the more likely they are to be noticed. So this was a stealthy way. It really was amazing that they actually lasted the six months. That’s how stealthy they were. **Francois Driessen:** But this is a multi-stage attack, like the classic: let’s drop onto there, and once the dropper is there, now you’re looking around, lay low for a little bit, look around a little bit, and then from there on start getting payloads, and then go to the next stage, and the next stage, and the next stage, right? Do I understand that correctly? **David Redekop:** That is correct. It always starts with: how do we get some code on the inside of the network without detection, and then how long can we have it do work on behalf of the attacker without being shut down, without being noticed, right? And so that multi-stage attack always at some point relies on the code reaching back to the attacker to say, “Here you are, here’s a bit of honey I have for you,” right? And that is the problem, is we still have a traditional thought process in almost organizations of all sizes that says we will allow everything to communicate as long as what it’s trying to do is not already known to be bad, right? That’s the fundamental flaw that made this still possible, along with the flaws that allow the code to get into SolarWinds. But we can’t, you and I and all of our clients, we can’t prevent software vendors’ workflow from having better quality control, right? What we can do today is we can say, “If this is on my network, these are my rules, right? And you are not talking outside, right, unless that outside is vetted.” **Francois Driessen:** Okay. Yeah, okay. So let’s say it was then reaching out to a domain, or there’s multiple domains, I guess, that FireEye released, where they’re going. How would the philosophy that ADAM uses, how would that actually prevent an attack like this? Can you explain that to me? **David Redekop:** Yes. So the philosophy of ADAMnetworks would not have done anything about sharpening the developers at SolarWinds. It would not have done anything about the clients getting an Orion update. But where adam:ONE comes into play is the moment that that Orion malicious update activates and it wants to tell the attacker, “Here, I have some data.” That’s when adam:ONE says, “Nope, that destination, we don’t know anything about it.” In fact, we don’t know that we know all of those domain names yet that it was reaching out to, but we do know of some. So even if FireEye released a bunch of backdoor beacon rules, and so you can actually look at all of these. So we’ve tested every single one of these when they come out. So here’s one, for example: it reaches out to incomeupdate.com, and if you were to look at your logs, if it had been used, you would have seen that. And so for example, if we were to open that up on our website here and try to go to incomeupdate.com, even if we attempted to, it would come back and say the unblocked request has been rejected. Not that the user would have experienced the web browser link, but more likely behind the scenes something like this was being done, like databasegalore.com is another one. And then that’s where you want to be able to see that it says connection refused. So the software behind the scenes would have reached out and no user would have seen anything on their screen. **Francois Driessen:** Yeah. **David Redekop:** But this is where adam:ONE says, “Nope, you’re failing to connect there.” That connection is refused. **Francois Driessen:** Right. Okay, so let’s say a client that’s now protected behind adam:ONE, they’d say they did get the dropper from the SolarWinds update. That is on their system, right? But now it’s trying to make a connection out. That connection is simply just refused. **David Redekop:** That’s right. **Francois Driessen:** So that’s where the attack, so it did get onto the system, right, but it couldn’t go to stage two, right? **David Redekop:** That’s right. So the attackers literally got as far as taking their thief and dropping them via chopper into the compound. **Francois Driessen:** Yeah. **David Redekop:** And now he’s about to leave with the bag of stone. He’s about to radio out. **Francois Driessen:** Oh yeah. “Hey, send the next piece of equipment, this is what we need to do here.” **Francois Driessen:** That’s what he’s doing, right? But he can’t radio out. **David Redekop:** He can’t even radio out, never mind taking out the data. He can’t do anything, right? **David Redekop:** So there’s this big tinfoil wrapped around that compound. He can’t get out. **David Redekop:** Okay. **David Redekop:** And therefore it gives the clients, the protected adam:ONE user, time to detect these kinds of things, right? **David Redekop:** And in any case, if it’s weeks or months or years, yes, that device cannot reach out. It just sits there trapped, waiting to be found, to be discovered. Unlike FireEye and all of these other infected clients, they were able to reach out, and just don’t know how far they got with how much data. **Francois Driessen:** Yeah, yeah. And I think it’s one of those things, just to speak about the idea of a next-generation appliance or something that is looking for patterns and continuously looking for hashes to say, “Oh, this is malware,” or “This is a pattern of malware.” But look, okay, so let’s say it sees that. That’s still not fast enough. Real time is not fast enough, because you have already been infected. This attack is already going on. So there’s a lot of value in that, because now you can see, “Okay, something is going on, let’s try to clean up the mess.” But wouldn’t it be better if nothing could go on in the first place? **David Redekop:** That’s right. **Francois Driessen:** And then, okay, so something bad is in there, but bad wasn’t allowed to do the bad thing. **David Redekop:** That’s right. **Francois Driessen:** And then you can clean that out, but the bad thing never was allowed to happen, right? **David Redekop:** That’s right, that’s right. We will simply never get to a point where we can absolutely prevent something bad from coming into the network. But what we do have a mechanism of is to make sure that that bad thing doesn’t lead to exfiltration, doesn’t lead to the next stage of an attack. That’s where it’s trapped. And every piece of malware at some point relies on that connection out. So we can absolutely stop 100 percent of command-and-control-based malware, which is almost all malware that is like that today. **Francois Driessen:** Right, yeah. So it will essentially stop 100 percent of attacks that are using that method. **Francois Driessen:** That method, which is the classic method, which should not be working today, but it is working today. **Francois Driessen:** That’s right. **Francois Driessen:** The good news is everyone that’s already behind adam:ONE protection, set up properly, you’ve already been protected. So the SolarWinds breach did not affect you. So congratulations. **Francois Driessen:** That feels good. **David Redekop:** That’s right. [Watch on YouTube](https://www.youtube.com/watch?v=egIEqExPURE) ## Related reading Case Study ### [Orion SolarWinds Breach: adam:ONE® vs Solarigate](https://adamnet.works/case-studies/solarwinds-solarigate-supply-chain-attack.md) November 11, 2024 Articles ### [The Telegram Problem](https://adamnet.works/blog/the-telegram-problem.md) December 27, 2021 Announcements ### [Attackers are using DNS TXT records to deliver malware and run C2](https://adamnet.works/blog/dns-txt-records-malware-delivery.md) September 9, 2025 ## See it on your own network Zero Trust Connectivity reduces attack surface 7000:1 by denying egress by default. Talk to us about what that looks like in your environment. [Request a Demo](https://adamnet.works/contact.md) [How adam:ONE® Works](https://adamnet.works/how-it-works.md)