MITRE ATT&CKsoftware (malware)

S0562 SUNSPOT

Published 2021-01-12 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2021-01-12

Description

SUNSPOT is an implant that injected the SUNBURST backdoor into the SolarWinds Orion software update framework. It was used by APT29 since at least February 2020.

Related

Uses · MITRE ATT&CK (12)

  • T1480.002 Mutual Exclusion sub-technique
  • T1195.002 Compromise Software Supply Chain sub-technique
  • T1565.001 Stored Data Manipulation sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1480 Execution Guardrails technique
  • T1134 Access Token Manipulation technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1027 Obfuscated Files or Information technique
  • T1057 Process Discovery technique
  • T1083 File and Directory Discovery technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (2)

  • C0024 SolarWinds Compromise campaign
  • G0016 APT29 group

References