PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
CISA ADVISORY

AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector

Published: 2020-12-17 • Issuing Agency: CISA • Official CISA Release ↗

Key Facts

  • Official advisory designation: AA20-352A.
  • Published on 2020-12-17 by CISA.
  • Directly correlated with 2 primary case dossier(s) in this library.
  • Provides joint government TTPs, MITRE ATT&CK indicators, and prioritized enterprise mitigations.

Referenced Common Vulnerabilities and Exposures (CVEs)

CVE-2020-10148 (NVD ↗)

Related Primary Court Cases & Incident Forensics

SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)

alleged 2020-12-13

Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.

Infiltration Vector: Russian Foreign Intelligence Service (SVR / APT29) operatives infiltrated SolarWinds internal software development environment and modified the automated build pipeline to inject the SUNBURST backdoor into legitimate Orion DLL source files.
5 techniques mapped · Loss: $200.0 million View full case dossier →

SEC v. SolarWinds Corp. & CISO Timothy G. Brown (Securities Fraud)

charged 2023-10-30

Landmark civil enforcement action brought by the SEC charging SolarWinds and its Chief Information Security Officer with securities fraud and internal accounting control failures, alleging company statements to investors overstated cyber defenses while internal executive communications conceded critical password and perimeter vulnerabilities.

Infiltration Vector: Initial access established against Public Markets & Corporate Governance infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark civil enforcement action brought by the SEC charging SolarWinds and its Chief Information Security Officer with securities fraud and internal accounting control failures, alleging company statements to investors overstated cyber defenses while internal executive communications conceded critical password and perimeter vulnerabilities.
1 techniques mapped · Loss: $26.0 million View full case dossier →

ATT&CK Techniques Cited in Advisory Matters

T1190: Exploit Public-Facing Application

"Adversaries inserted malicious source code (SUNBURST) into legitimate SolarWinds Orion build pipelines, resulting in digitally signed malicious updates."

T1071.001: Web Protocols

"The backdoor communicated with adversary command and control servers via HTTP requests designed to mimic legitimate SolarWinds Orion communication protocols."

T1078: Valid Accounts

"Adversaries abused stolen SAML signing keys to forge authentication tokens and bypass multifactor authentication in victim Microsoft 365 environments."

T1132: Data Encoding

"SUNBURST encoded stolen domain information into custom Base64-like strings disguised as GUID query parameters."

T1036: Masquerading

"The TEARDROP memory-only dropper masqueraded as legitimate Windows system services to maintain persistent memory presence."

T1078: Valid Accounts

"SEC Complaint alleged SolarWinds maintained insecure credential management practices, including solarwinds123 password on public GitHub repos."