If it’s “Russia” why are they investigating if the execs were in on it?

“HAGENS BERMAN, NATIONAL TRIAL ATTORNEYS, Investigating SolarWinds (SWI) $285 Million Insider Stock Sales, Knowledge of Hack in Orion Products, Encourages SWI Investors with Losses to Contact Firm Now” https://t.co/n7AHw51r4m
SolarWinds report (Feb 2020): “2020 Key Findings
For the fifth year in a row, careless and untrained insiders are the leading source of security threats for public sector organizations”

https://t.co/TjgcuaBzUb
“‘Security is everyone’s job, but holding the team accountable is lacking. Until there are real individual accountability regimens in place, the network will remain at risk.’
- Division Chief, Federal Civilian”
Again insiders are the top threat, why ignoring in public rhetoric?

https://t.co/603WejHoYG
It doesn’t add up https://t.co/1MNMdHqyH6
Why would SolarWinds ignore this warning?

https://t.co/VVQ7TqlUzW
Important article

“The SolarWinds Perfect Storm: Default Password, Access Sales and More” https://t.co/a1xHU46nON via @threatpost
“Orion is a product with such market dominance that company CEO Kevin Thompson bragged on an October earnings call that “.....We manage everyone’s network gear.”
“In addition to its overall footprint, perhaps what made SolarWinds the most attractive vector for the attackers however is its sheer reach into customer networks.”
“access to the full network....Compromising SolarWinds makes sure an attacker does not have to worry about firewalls and other preventative security solutions.... It knows EVERYTHING on your network.”

- Marcus Hartwig, manager of security analytics, Vectra
“users of SolarWinds are IT/network admins with privileged access accounts”
“cybercriminals were spotted hawking access to SolarWinds’ infrastructure in underground forums, as far back as 2017”
“One of the access-dealers, they said, was the notorious Kazakh native known as ‘fxmsp’”
“German newspaper flagged the fact that SolarWinds has a support page advising users to disable antivirus scanning” (!) in Orion folders
“authorities have identified fxmsp as a 37-year-old Kazakhstan citizen named Andrey Turchin” https://t.co/TH0AnXfREl
“established backdoors to corporate networks and then sold them in cybercrime forums for thousands to hundreds of thousands of dollars”
“Think of almost any kind of company and there’s a good chance a prolific, financially-motivated hacker known as Fxmsp has broken into it, or attempted to” https://t.co/WpOWvufeHF
“starts by scanning for open Remote Desktop Protocol ports and then brute-forcing their way into networks. They then steal administrative credentials and modify antivirus software settings to make sure their malware remains undetected.” https://t.co/TH0AnXfREl
“sold backdoor access to hundreds of corporate networks in 44 countries via Russian-language underground forums” https://t.co/pRU52RSMy1
https://t.co/6Ex9IpsZPu
Remember the Equifax hack

https://t.co/m7yWUOxHFH
“On March 7, 2017, the Apache Software Foundation announced that some versions of its Apache Struts software had a vulnerability that could allow attackers to remotely execute code on a targeted web application.”

More from Dannielle (Dossy) Blumenthal PhD

SolarWinds follow up. Very good tweet explaining what happened.


Basically what this means is that SolarWinds itself was exploited. Someone posted an infected update as legitimate (digitally signed), leading customers to download a bad update.

“Multiple trojanized updates were digitally signed from March - May 2020 and posted to the SolarWinds updates website” https://t.co/8e3bMFWXYu


FireEye then explains that infected organizations were approached and exploited. This is a separate Step 2.

At this point, information is already going to “malicious domains” without extra intervention, after the malware does nothing for “up to two weeks”
Sharing.


“What authority does POTUS have specifically over the Marines?”

“only branch of service that falls directly under exec command”

“Nati Sec Act of 1947, amended in 1952, specifies the duties of the USMC to include: ‘perform such other duties as the president may direct.’”


This is the QProof. Go back


10/31/2017, Q wrote:

“Why is ANTIFA allowed to operate?
Why hasn't the MB been classified as a terrorist org?
What happens if Soros funded operations get violent and engage in domestic terrorism?
What happens if mayors/ police comms/chiefs do not enforce the law?”

2020...


How is it possible?

More from For later read

You May Also Like