On Dec. 13, 2020, FireEye, Microsoft, and SolarWinds announced the discovery of a large, sophisticated supply chain attack that deployed a new, previously unknown malware “Sunburst” used against SolarWinds’ Orion IT customers.
While studying the Sunburst backdoor, experts from cybersecurity firm Kaspersky discovered a number of features that overlap with a previously identified Kazuar, a backdoor written using the .NET framework first reported by Palo Alto in 2017 and used in the cyberespionage attacks across the globe. Multiple similarities in code suggest a connection between Kazuar and Sunburst, albeit of undetermined nature.
Kazuar backdoor is the type of malware that provides remote access to a victim’s machine.
Kaspersky reveals Lazarus APT group targets vaccine research
Kaspersky forecasts exploits in elections, healthcare, 5G deployment this year
The overlapped features between Sunburst and Kazuar include the victim UID generation algorithm, the sleeping algorithm, and the extensive usage of the FNV-1a hash. According to the experts, these code fragments are not 100% identical, suggesting Kazuar and Sunburst may be related, though the nature of this relation is still not entirely clear.
After the Sunburst malware was first deployed, in February 2020, Kazuar continued to evolve and later 2020 variants are even more similar in some respect to Sunburst.
Overall, during the years of Kazuar evolution, the experts observed a continuous development, in which significant features that bear resemblance to Sunburst, were added. While these similarities between Kazuar and Sunburst are notable, there could be a lot of reasons for their existence, including Sunburst being developed by the same group as Kazuar, Sunburst developers using Kazuar as an inspiration point, the move of one of Kazuar developers to the Sunburst team, or both groups behind Sunburst and Kazuar having obtained their malware from the same source.
“The identified connection does not give away who was behind the SolarWinds attack, however, it provides more insights that can help the researchers move forward in this investigation. We believe it’s important that other researchers around the world investigate these similarities and attempt to discover more facts about Kazuar and the origin of Sunburst, the malware used in the SolarWinds breach,” said Costin Raiu, director of Kaspersky’s Global Research and Analysis Team.
To avoid risks of being infected by malware such as the Sunburst backdoor, Kaspersky recommends:
- Provide your SOC team with access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal grants access to the company’s TI, providing cyber attack data and insights gathered by Kaspersky for more than 20 years. Free access to its curated features that allow users to check files, URLs and IP addresses is available here.
- Organizations that would like to conduct their own investigations will benefit from Kaspersky Threat Attribution Engine. It matches discovered malicious code against malware databases, and, based on the code similarities, attributes it to previously revealed APT (advanced persistent threats) campaigns.