MALWARE FAMILY

SUNBURST

Internal ID: win.sunburst

aliases

Last seen:Mar 17, 2026

Intelligence Profile

FireEye describes SUNBURST as a trojanized SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. After an initial dormant period of up to two weeks, it uses a DGA to generate specific subdomains for a set C&C domain. The backdoor retrieves and executes commands, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The C2 traffic to the malicious domains is designed to mimic normal SolarWinds API communications: Orion Improvement Program (OIP) protocol. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers. Multiple trojanzied updates were digitally signed from March - May 2020 and posted to the SolarWinds updates website.

Threat Analysis

SUNBURST is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/

→https://blog.apiiro.com/detect-and-prevent-the-solarwinds-build-time-code-injection-attack

→https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html

→https://blog.cloudflare.com/a-quirk-in-the-sunburst-dga-algorithm/

→https://blog.cloudflare.com/solarwinds-orion-compromise-trend-data/

→https://blog.gigamon.com/2021/07/27/ghosts-on-the-wire-expanding-conceptions-of-network-anomalies/

→https://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html

→https://blog.prevasio.com/2020/12/sunburst-backdoor-part-ii-dga-list-of.html

→https://blog.prevasio.com/2020/12/sunburst-backdoor-part-iii-dga-security.html

→https://blog.reversinglabs.com/blog/sunburst-the-next-level-of-stealth

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.sunburst

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SUNBURST