Threat Advisory: SolarWinds supply chain attack

Update 12/18: We have been able to verify the name server for the DGA domain was updated as far back as late February. Compromised binaries appear to have been available on the SolarWinds website until very recently. The blog below has been amended with this informaiton. The IOC list has been modified.  Update 12/17: Additional IOCs added related to teardrop secondary payload. Update 12/16: Based on the announcement from FireEye, Microsoft, and GoDaddy avsvmcloud[.]com has been unblocked...

[[ This is only the beginning! Please visit the blog for the complete entry ]]