UNC2452__2022__SUNSPOT_Malware_A_Technical_Analysis.pdf

This report analyzes SUNSPOT, a StellarParticle malware used to inject the SUNBURST backdoor into SolarWinds Orion software builds. It covers SUNSPOT's build-process hijacking, process monitoring of MsBuild.exe, encrypted logging and AES-128-CBC protection of targeted files, persistence via scheduled tasks, and the fraudulent replacement of source code to enable backdooring, highlighting a sophisticated supply-chain intrusion with broad potential impact.