MITRE ATT&CKsoftware (malware)

S0578 SUPERNOVA

Published 2021-02-18 Modified 2024-04-10 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.1
Created: 2021-02-18

Description

SUPERNOVA is an in-memory web shell written in .NET C#. It was discovered in November 2020 during the investigation of APT29's SolarWinds cyber operation but determined to be unrelated. Subsequent analysis suggests SUPERNOVA may have been used by the China-based threat group SPIRAL.

Uses · MITRE ATT&CK (5)

T1027.013 Encrypted/Encoded File sub-technique
T1071.001 Web Protocols sub-technique
T1036.005 Match Legitimate Resource Name or Location sub-technique
T1505.003 Web Shell sub-technique
T1203 Exploitation for Client Execution technique

References

https://us-cert.cisa.gov/ncas/analysis-reports/ar21-027a CISA Supernova Jan 2021
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/ Microsoft Analyzing Solorigate Dec 2020
https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/ Guidepoint SUPERNOVA Dec 2020
https://www.solarwinds.com/sa-overview/securityadvisory SolarWinds Advisory Dec 2020
https://unit42.paloaltonetworks.com/solarstorm-supernova/ Unit42 SUPERNOVA Dec 2020

S0578 SUPERNOVA

Description

Related

Uses · MITRE ATT&CK (5)

References