The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).
As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).





Type A: Decodes/Loads CS's RL from the DLL’s DATA section (detected as Trojan:Win64/Solorigate.SC!dha)
Type B: De-obfuscates/Loads RL from the DLL’s CODE section (aka #Raindrop, detected as Trojan:Win64/Solorigate.SB!dha).

The custom loader DLLs were introduced to compromised systems between the hours of 8:00 AM and 5:00 PM UTC. In one intrusion, the first 2nd stage custom loader (TEARDROP) was introduced to the environment by SolarWinds.BusinessLayerHost.exe at ~ 10:00 AM UTC.


More from Business
1/An interesting thing happened tonight. I was scrolling through clubhouse and found WileyCEO, Godfather of Grime (kicked off Twitter in July for antisemitic tweets) speaking. So I tweeted this (and included a screen shot, later deleted as I found out TOS don't allow it ...
2/ ... and several folks also asked me to remove it which I promptly did afterwards).... Coming into the CH room, I fully intended to confront him about how hurtful his comments in July were. But as I listened to the folks in the room, I decided to go a different direction ....
3/ the conversation jumped around, covered many topics and there were between 8-14 people up on stage. But a recurring thread was discussion of racism, bigotry, comparison of it in the US vs UK vs elsewhere.
4/ when I got a chance to speak, I had 5 bullets written down: a) we should harness technology and capitalism to make reparations for what America did to Black people. I gave https://t.co/SlrW8zCd58 (a project a couple friends co-started) as an example) ...
5/ b) capitalism and product know-how and technology can be harnessed for social justice c) historically oppressed minorities need to stick together and lastly, d) "Wiley, how could you say such hurtful things about Jews as a people?" That's what I had ready to say, anyway.

2/ ... and several folks also asked me to remove it which I promptly did afterwards).... Coming into the CH room, I fully intended to confront him about how hurtful his comments in July were. But as I listened to the folks in the room, I decided to go a different direction ....
3/ the conversation jumped around, covered many topics and there were between 8-14 people up on stage. But a recurring thread was discussion of racism, bigotry, comparison of it in the US vs UK vs elsewhere.
4/ when I got a chance to speak, I had 5 bullets written down: a) we should harness technology and capitalism to make reparations for what America did to Black people. I gave https://t.co/SlrW8zCd58 (a project a couple friends co-started) as an example) ...
5/ b) capitalism and product know-how and technology can be harnessed for social justice c) historically oppressed minorities need to stick together and lastly, d) "Wiley, how could you say such hurtful things about Jews as a people?" That's what I had ready to say, anyway.
Facebook originally a CIA program called "LifeLog".
LifeLog, via DARPA, terminated on Feb 4th, 2004.
Facebook was launched on Feb 4th, 2004.
Many of the LifeLog team became execs at FB.
Zuckerberg is a figurehead.
CIA allowed Cambridge to help Trump win
https://t.co/enzOXDCogV
Pentagon Kills LifeLog
LifeLog, via DARPA, terminated on Feb 4th, 2004.
Facebook was launched on Feb 4th, 2004.
Many of the LifeLog team became execs at FB.
Zuckerberg is a figurehead.
CIA allowed Cambridge to help Trump win
https://t.co/enzOXDCogV

Project: Lifelog
— Robert Horan (@Robby12692) December 13, 2018
Started by DARPA in 1999, the goal of Lifelog was to create a database on civilians without their knowledge, and track everything they do.
The project "ended" on Feb 4th, 2004.
Facebook began the exact same day.
The CIA funneled tens of millions into Facebook. pic.twitter.com/r7hwF0v9kh
Pentagon Kills LifeLog