Haven't been on in 24 hours and just did a quick check for this on qresearch. Can't find anything, so am posting this. My apologies if you all have seen it though.

SolarWinds Tactics, Techniques, and Procedures (TTPs) Used in the SolarWinds Breach

Written by Süleyman Özarslan, PhD | Dec 15, 2020 3:06:58 PM

EXECUTIVE SUMMARY

SolarWinds announced on Sunday that the SolarWinds Orion Platform network monitoring product had been modified by a state-sponsored threat actor via embedding backdoor code into a legitimate SolarWinds library. This leads to the attacker having remote access into the victim’s environment and a foothold in the network, which can be used by the attacker to obtain privileged credentials. SolarWinds breach is also connected to the FireEye breach. In this article, we analyzed tactics, techniques, and procedures utilized by threat actors of the SolarWinds incident to understand their attack methods and the impact of this breach.

Key Findings

It is a global attack campaign that started in March 2020 and is ongoing.

The attack campaign has the potential to affect thousands of public and private organizations.

The attack started with a software supply chain compromise attack.

Threat actors trojanized a component of the SolarWinds Orion Platform software, dubbed as SUNBURST by FireEye [1].

The backdoored version of the software was distributed via its automatic update mechanism.

Attackers heavily used various defense evasion techniques such as masquerading, code signing, obfuscated files or information, indicator removal on host, and virtualization/sandbox evasion.

The threat actor leverages ten different MITRE ATT&CK tactics, including Lateral Movement, Command and Control, and Data Exfiltration.

Used techniques indicate that the threat actors are highly skilled.

Full article and document here:

https://www.picussecurity.com/resource/blog/ttps-used-in-the-solarwinds-breach

https://www.picussecurity.com/resource/blog/ttps-used-in-the-solarwinds-breach?hs_amp=true&__twitter_impression=true