Last updated on September 21st, 2026 at 08:49 am
In December 2020, during the SolarWinds breach, I remember thinking it was another advanced hack. However, after reviewing the technical report and observing the way offenders changed the playbook in the following five years, it became obvious: SolarWinds was not merely an incident–it was a manual.
By 2025, supply chain attacks have become almost routine, with countries individually carrying out a supply chain attack once a week. The strategy behind SUNBURST and SUNSPOT didn’t vanish; it just got upgraded, automated, and even multiplied across GitHub repos, npm packages, and CI/CD pipelines. This article breaks down how the SolarWinds attack succeeded, how the lifecycle has changed, and what modern attack vectors look like heading into 2026.
Table of Contents
The SolarWinds Breach: SUNBURST and SUNSPOT Explained
The scale of the SolarWinds compromise isn’t what’s remarkable; about 18,000 customers downloaded the trojanized Orion update, but what is remarkable is how precisely it was executed. The attackers didn’t use a zero-day exploit to force their way in. They were incorporated into the software.
How SUNSPOT Hijacked the Build Process
SUNSPOT made this possible. According to CrowdStrike and Mandiant, the attackers breached SolarWinds’ development environment and inserted SUNSPOT into the production line. It wasn’t a single code injection; it was a long-running one.
Here’s how it worked:
- SUNSPOT monitored the build environment for certain Orion software compilation actions.
- When it found the right target build, it replaced authentic source code with malicious code.
- This replacement happened before compilation, so the malicious code was included in the signed binary.
- After the build completed, SUNSPOT covered its tracks by restoring the source files.
What made this so effective? The rogue DLL was an Orion component that replicated a legitimate part. It was digitally signed with SolarWinds’ own certificate, automatically checked, integrated with thousands of other files, and appeared to be a normal Orion installation.
SUNBURST’s Stealthy Command and Control
After the trojanized update was downloaded to customer environments, SUNBURST’s process took effect. However, it did not begin right away. The malware took about two weeks to become functional, as it integrated into normal network traffic, mimicking the Orion Improvement Program protocol.
I have inspected the decompiled samples of SUNBURST, and it is very sophisticated:
- Delayed execution: 12-14 days of sleeping to prevent sandbox detection.
- Domain generation algorithm (DGA): Subdomains previously used under the valid avsvmcloud[.]com domain were used to encode victim information.
- Process blocklisting: Scanned with security tools and stopped in the case of detection.
- Selective targeting: Second-stage payloads such as TEARDROP or Cobalt Strike BEACON were only applied to a small number of infected organizations.
The intruders were not attempting to breach all 18,000 consumers. They selectively targeted high-value targets, such as government agencies, security firms, and critical infrastructure operators, with more in-depth attacks.
Attack Lifecycle: From Reconnaissance to Full Compromise
The SolarWinds case helps map the broader supply chain attack lifecycle. This pattern repeats across other vectors, whether an npm package or a rogue build server.
Stage 1- Reconnaissance and Initial Access
Attackers were inside SolarWinds’ network before SUNSPOT was deployed. FireEye’s investigation suggested the first breach may have involved credential theft or phishing of developers with high access.
In modern reconnaissance, one is seeking:
- Developer accounts that are allowed to access important repositories.
- Build servers with weak authentication or open security holes.
- Third-party connectors (GitHub Actions, Azure DevOps, Jenkins) using excessively liberal tokens.
In my experience testing internal pipelines, organizations often give CI/CD systems far more access than they need. One vulnerable service account will install code and cause some building and signing of artifacts-all this is what an attacker requires.
Stage 2 – Code Injection and Tampering
Attackers inject malicious code into the build environment so it survives compilation and signing. The SolarWinds model (SUNSPOT-style build tampering) is still widespread, although some variations have been developed:
- Direct commits of code: With stolen developer credentials, attackers back-door code into major branches and merge it in.
- Dependency poisoning: Substituting a valid library with code that contains malicious code as part of the build fetch process.
- Manipulation of build scripts: To download and run malicious code, attackers need to change CI/CD configuration files (GitHub Actions YAML, Jenkinsfiles).
In a report released by ReversingLabs, more than a 1,300% increase in malicious packages on npm, PyPI, and RubyGems was recorded between 2020 and 2023, showing that attackers industrialized the injection process.
Stage 3 – Distribution Through Trusted Channels
Distribution is the genius in supply chain attacks. Rather than phishing thousands of targets one after another, the attackers target a single vendor and use its software update mechanism to reach the rest.
SolarWinds announced SUNBURST by:
- Authorized, signed, and digitized software updates through the automatic update option at the Orion platform.
- Allowed download servers that customers trusted.
- Authorized outlets that could bypass the majority of perimeter controls.
This trend has now been applied to package registries, container images, and cloud templates. When users trust the source, they download and implement it without further questioning.
Stage 4 – Activation and Lateral Movement
Activation is the step when attackers shift from presence to exploitation. SUNBURST’s two-week dormancy period was planned; it evaded most sandbox and behavioral-analysis detection windows.
Once active, the malware:
- Hampered pair command-and-control (C2) links under the pretense of genuine traffic.
- Obtained more tools (TEARDROP dropper, Cobalt Strike, self-made frameworks)
- Transferred to a different environment later using stolen credentials from the compromised environment.
- Leaked confidential information or maintained a constant presence in the form of intelligence collection.
Mandiant observed that the attackers maintained high operational security, rotated infrastructure, used ephemeral payloads, and avoided noisy activities that would trigger alarms.
I’ve Seen Modern Supply Chain Attack Vectors Evolve
Though build-pipeline compromise became popular with SolarWinds, the threat landscape has expanded. This is what’s being attacked now.
GitHub and Code Repository Attacks
GitHub is not merely a code host; it is a key component of the supply chain of millions of projects. It is attacked on numerous layers by attackers:
Personal Access Tokens (PATs) and SSH keys: I observed in security audits that developers often leave long-lived tokens in plain text in their scripts. Stolen credentials can grant full repository access, including the ability to make malicious commits.
Subverting Workflows: Malicious Attackers Hack developer accounts to edit CI/CD workflows and add malicious steps that run when builds are triggered automatically. These workflows are often given access to production environments, artifact registries, and cloud infrastructure as engineers.
Dependency Confusion: Attackers use registries (npm, PyPI) and publish malicious packages with names similar to internal dependencies. The build system may also not be configured to prioritize private sources, so it pulls the public (malicious) one.
Open-Source Ecosystem Attacks
The open-source software supply chains represent large attack surfaces. In mid-2025, ReversingLabs stated that demand for software supply chain incidents averaged 26 per month, about twice the level in 2024.
Common techniques include:
- Typosquatting: Registering packages under a similar name to well-known libraries (ex: “reqests” instead of requests).
- Maintainer account takeover: Fraud in which package maintainers are phished or credential-stuffed and then manage to publish backdoored updates.
- Malicious pull requests: Malicious actors create apparently useful code that then becomes a backdoor data-exfiltration capability.
What makes it especially perilous is trust. Developers often trust packages that have thousands of downloads and many contributors. This is used by attackers by targeting popular projects such that one rogue update serves millions of installations.
CI/CD Pipeline Compromise
The new jewels are build pipelines. Breaking a CI/CD system lets attackers poison every artifact that passes through it.
Weaknesses in environments that I have tested can be of the following types:
- Instances of hyperprivileged build servers (with access to an administrator or cloud root).
- Environment variables that had secrets and API keys that were not rotated.
- Lack of isolation between build jobs (build jobs can access artifacts of other jobs)
- Failure to verify build inputs (dependencies, base images, scripts). Lack of integrity: transferable, not inspectable, to verify input validation.
Veracode’s 2025 analysis also found that integrity validation and provenance tracking are weak in most organizations, making it easy to introduce malicious code into production builds without detection.
High-Profile Targets and Industry Lessons Since SolarWinds
SolarWinds showed that supply-chain attacks scale easily. Since then, attackers have perfected their methods and targets.
Managed Service Providers and Cloud Platforms
ENISA listed cloud-based and managed service providers (MSPs) as valuable supply chain suppliers to attackers, creating centralized platforms that give them access to hundreds or thousands of downstream consumers.
Notable incidents include:
- Kaseya VSA (2021): The REvil ransomware group broke into Kaseya’s remote management system and distributed ransomware to an estimated 1,500 downstream enterprises.
- Okta breach (2022): Hackers accessed Okta’s support environment, potentially compromising customer authentication information.
- 3CX VoIP repeatable (2023): Hackers of North Korean interest trojanized the 3CX desktop application and hit hundreds of thousands of users worldwide.
The moral of the story is that attackers target multiplier effects. A single compromise of an MSP or SaaS provider will provide access to the whole customer base.
Critical Infrastructure and Government Agencies
SolarWinds targeted government organizations, defense contractors, and critical infrastructure operators. This pattern continues.
Confirmed victims in the SolarWinds case included the U.S. Treasury, the Department of Commerce, the Department of Homeland Security, and other major cybersecurity companies.
Attackers were not interested in making a profit but in spying on people, valuing intelligence over ransomware.
This has escalated its targets to:
- Control systems and SCADA networks in the energy sector.
- Medical device firmware (equipment, medical devices, and data storage in clinics) and Hospital management systems.
- Telecommunications equipment (5G network equipment, routing equipment)
Emerging AI and ML Supply Chain Risks
AI model supply chains are one area I have been keeping a close eye on. In its report on how AI will be in 2025, ReversingLabs specifically identified AI and the supply chains of AI and ML software as a new attack frontier, as threat actors now attack both AI model repositories and AI-generated code.
The possible attack vectors are:
- Poisoned data used in training that places a backdoor into models.
- Evil pre-trained models: a malicious BoTox model written in Hugging Face, TensorFlow Hub, or PyTorch.
- Code generated by AI that inserts malicious libraries or serves to inject subtle vulnerabilities.
- IDE plugins consisting of compromised AI development IDEs (VS Code extensions, JetBrains tools)
This remains a growing menace, yet the organizational infrastructure of AI development resembles the software supply chain strong-room databanks, personal tycoon removes and for any reason extensive confidence presumption.
Software Supply Chain Security: Defenses That Actually Work
The good news is that defenses are increasing. Companies and governments are promoting stricter Software Supply Chain Security measures that would close the vulnerabilities that existed in SolarWinds.
SBOMs and Transparency Requirements
SBOMs have shifted from a nice-to-have to a requirement. SBOMs are now legally required in CISA 2024-2025 guidance and in the EU, making transparency law.
SBOM comprises all the components, libraries, and dependencies of a software artifact. When properly used, it makes it possible to:
- Quick response to the vulnerability stage (being immediately aware whether you have been compromised by a new CVE or not)
- Supply chain risk (risk identification of high-risk or unmaintained dependencies)
- Triage (reflecting on compromised elements of deployed systems)
Nonetheless, SBOMs are not sufficient. They must be accompanied by integrity verification (digital signatures, attestations) and ongoing monitoring.
Build Attestations and Provenance Tracking
To avert SUNSPOT-style manipulation, organizations are adopting build attestation systems such as SLSA (Supply-chain Levels for Software Artifacts). These frameworks ensure:
- Hermetic builds: Build systems are reproducible and closed off.
- Signed provenance: Each artifact has metadata that attests to where, when, and how it was constructed.
- Checking gates: Checking systems reject artifacts with invalid attestations.
Gartner rates that Software Supply Chain Security tools will be used by 60 percent of large enterprises by 2025 (increasing to 85 percent in 2028), largely due to compliance pressures and successive high-profile breaches.
Runtime Integrity Monitoring
Although strong build controls matter, runtime monitoring is also important. I’ve used tools that detect:
- Unanticipated process execution (particularly entry by software update mechanisms)
- Deviant network connections of trusted applications.
- Any intrusion involving a file integrity breach on key system directories.
- The pattern of credential theft or lateral movement.
The SolarWinds attack succeeded in part because runtime monitoring didn’t suspect SUNBURST’s C2 beaconing. Modern software supply chain security methods apply behavioral analytics and threat intelligence to detect the post-compromise activity earlier.
What’s Coming: 2026 and Beyond
In the future, supply chain attacks will remain industrialized. Here’s what’s likely:
AI-Assisted Attacks: By generating code automatically, attackers will find it easier to build polymorphic code and avoid static analysis at scale.
Regulatory Force: The Cyber Resilience Act is one of many regulations that can force vendors to adopt secure-by-design practices and require vulnerability disclosures.
Use Shift-Left Security: Companies will incorporate supply chain controls earlier in the development process, scanning dependencies, verifying inputs, and adding policy gates in CI/CD.
Enhanced Attack on Developers: Social engineering of developers will go up a notch, involving credential theft coupled with supply chain injection.
Conclusion
The SolarWinds breach was not a wake-up call – it was a playbook. The supply-chain compromise was entrenched, as seen in the SUNSPOT build disguising itself as the stealthy C2 of SUNBURST. Five years later, the techniques have spread to GitHub repositories, open-source ecosystems, and CI/CD pipelines.
What’s changed is awareness. SBOMs are becoming standard. Attestations of builds are taking off. Regulators are holding vendors accountable. However, attackers are also evolving, attacking AI pipelines and cloud applications and increasingly targeting developer workflows.
Survivability in the next wave depends not only on how organizations respond to threats but on designing those supply chains to be integrity-based and transparent throughout.
I’m a technology writer passionate about AI and digital marketing. I create engaging and useful content that bridges the gap between complex technology concepts and digital technologies. My writing makes the process easy and engaging. I encourage participation I continue to research innovation and technology. Let’s connect and talk technology!
