U.S. Treasury, Commerce Department, USG Agencies Hacked Through SolarWinds [Dominion IT Provider] Software Backdoor

Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, experts say the incident may be just the first of many such disclosures.

Government agencies have issued warnings about the fresh spate of attacks, apparently from nation-state actors against major security vendors.

For those new to the #solarwinds issue.

In a nutshell, China had "God mode" access to anything updated with Solarwind software, including Dominion. #Election2020 https://t.co/YUuZAmfVp6

— T. Boone 🇺🇸 (@tbooneus) December 15, 2020

This means the US SolarWinds product is 💯 compromised across the USG. Likely China w/ back doors to every dept, agency & activity in the USG. Not good. @realDonaldTrump this is a grave natl scty threat, esp at this moment. Demand answers ASAP! Know you will. https://t.co/SxxUsoLvFP

— General Flynn (@GenFlynn) December 14, 2020

The SolarWinds Director sold $45.7 MILLION in stock options before the security hack hit the news

Kreb Security…..hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury and Commerce departments. Reuters reports the attackers were able to surreptitiously tamper with updates released by SolarWinds for its Orion platform, a suite of network management tools.

In a security advisory, Austin, Texas based SolarWinds acknowledged its systems “experienced a highly sophisticated, manual supply chain attack on SolarWinds Orion Platform software builds for versions 2019.4 HF 5 through 2020.2.1, released between March 2020 and June 2020.”

In response to the intrusions at Treasury and Commerce, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) took the unusual step of issuing an emergency directive ordering all federal agencies to immediately disconnect the affected Orion products from their networks.

“Treat all hosts monitored by the SolarWinds Orion monitoring software as compromised by threat actors and assume that further persistence mechanisms have been deployed,” CISA advised.

A blog post by Microsoft says the attackers were able to add malicious code to software updates provided by SolarWinds for Orion users. “This results in the attacker gaining a foothold in the network, which the attacker can use to gain elevated credentials,” Microsoft wrote.

From there, the attackers would be able to forge single sign-on tokens that impersonate any of the organization’s existing users and accounts, including highly privileged accounts on the network.

“Using highly privileged accounts acquired through the technique above or other means, attackers may add their own credentials to existing application service principals, enabling them to call APIs with the permission assigned to that application,” Microsoft explained.

Malicious code added to an Orion software update may have gone undetected by antivirus software and other security tools on host systems thanks in part to guidance from SolarWinds itself. In this support advisory, SolarWinds says its products may not work properly unless their file directories are exempted from antivirus scans and group policy object restrictions.

REVEALED: SolarWinds Director Sold $45.7 MILLION in Stock Options Last Week Before CISA Announcement Sunday

By Jim Hoft, Gateway Pundit. December 14, 2020:

Last night the Cybersecurity and Infrastructure Security Agency (CISA) issued a rare Emergency Directive 21-01, in response to a KNOWN COMPROMISE involving SolarWinds Orion products.

This was only the fifth Emergency Directive issued by CISA under the authorities granted by Congress in the Cybersecurity Act of 2015

CISA reported a breach of the SolarWinds Orion products.

This Emergency Directive called on all federal civilian agencies to review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately.

This Emergency Directive called on all federal civilian agencies to review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately.

Dominion is still not powered down.

Now comes news that SolarWinds Co. Director Aurora Co-Invest L.P. Slp sold 2,079,823 shares of the business’s stock in a transaction last Monday, December 7th.

Shares of SWI opened at $23.55 on Friday. SolarWinds Co. has a 12-month low of $11.50 and a 12-month high of $24.34. The business has a 50-day simple moving average of $22.17 and a two-hundred day simple moving average of $20.10. The company has a quick ratio of 1.06, a current ratio of 1.06 and a debt-to-equity ratio of 0.70. The stock has a market cap of $7.40 billion, a PE ratio of 261.70 and a beta of 1.20.

RELATED ARTICLES:

WATCH LIVE: Dominion Voting CEO Testifies at Michigan Legislature Hearing

Dominion Audit: Ballot Error Rate Was At Least 85,000 Times Higher Than FEC Allows

EDITORS NOTE: This Geller Report column is republished with permission. ©All rights reserved.

---