The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).
As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).
Type A: Decodes/Loads CS's RL from the DLL’s DATA section (detected as Trojan:Win64/Solorigate.SC!dha)
Type B: De-obfuscates/Loads RL from the DLL’s CODE section (aka #Raindrop, detected as Trojan:Win64/Solorigate.SB!dha).
The custom loader DLLs were introduced to compromised systems between the hours of 8:00 AM and 5:00 PM UTC. In one intrusion, the first 2nd stage custom loader (TEARDROP) was introduced to the environment by SolarWinds.BusinessLayerHost.exe at ~ 10:00 AM UTC.
More from Business
Should we go into the details of these 125 years?
SA is built on the exploitation of labour. That labour has functioned on alcohol unfortunately. Very few people consume liquor purely for enjoyment unfortunately. When SAB opened its doors 1895 workers were paid in alcohol- the dop/tot system. 2 years into SAB's establishment
The Prohibition Act is introduced. This means black people are barred from buying your wines, beer etc. So SAB's products are exclusively for white people. But during this period beer brewing by Black women is the norm. Ayinxilisi ncam ke this type of beer. Apparently it had some
Nutritious elements to it. Now some of the context around drinking culture during this time is migrant labour to the mines, further land dispossession, the Anglo-Boer Wars, Rhodes corruption (our first state capture commission if you will) which leads to his resignation.
This context plays a role in how our cities and small towns are constructed, how they lead to the confinement and surveillance yabantu. Traditional beer brewing is identified as a threat because buy now mining bosses have identified that there's money to be made here.
SAB has formed part of the fabric of SA for the last 125 years & we've stood behind the nation through its triumphs & challenges. After much consideration,SAB has decided to approach the Courts to challenge the Constitutionality of the decision taken to re-ban the sale of alcohol pic.twitter.com/40rWpJSW5b
— SABreweries (@SABreweries) January 6, 2021
SA is built on the exploitation of labour. That labour has functioned on alcohol unfortunately. Very few people consume liquor purely for enjoyment unfortunately. When SAB opened its doors 1895 workers were paid in alcohol- the dop/tot system. 2 years into SAB's establishment
The Prohibition Act is introduced. This means black people are barred from buying your wines, beer etc. So SAB's products are exclusively for white people. But during this period beer brewing by Black women is the norm. Ayinxilisi ncam ke this type of beer. Apparently it had some
Nutritious elements to it. Now some of the context around drinking culture during this time is migrant labour to the mines, further land dispossession, the Anglo-Boer Wars, Rhodes corruption (our first state capture commission if you will) which leads to his resignation.
This context plays a role in how our cities and small towns are constructed, how they lead to the confinement and surveillance yabantu. Traditional beer brewing is identified as a threat because buy now mining bosses have identified that there's money to be made here.
