UNC2452__2021__crowdstrike.com-SUNSPOT_An_Implant_in_the_Build_Process.pdf

CrowdStrike provides a technical analysis of SUNSPOT, a StellarParticle malware implant used to intercept SolarWinds Orion software builds and inject SUNBURST into update packages. The report details how SUNSPOT monitors MsBuild.exe, hijacks the build, replaces InventoryManager.cs with a backdoored version, uses AES-128-CBC and RC4 to protect code and logs, and persists via boot-time scheduled tasks while exposing a set of mutexes and log formats that aid detection and analysis. It also maps the tactics and procedures to the ATT&CK framework and lists host indicators and YARA rules associated with SUNSPOT.