#SolarWinds hack update thread.

One word of caution, particularly for reporters publicizing hack victims. Many of the Orion platform customers have downloaded the backdoored update and it would have likely eventually contacted the C2 servers 1/4

Those backdoors and C2 connections are now being discovered by IR teams that are searching logs and systems for indicators published by @FireEye. However, this discovery does not necessarily mean the attackers did anything damaging to that organization 2/4

In fact, most appear to have done a DNS lookup to the C2 server and received back a ‘kill switch’ response that indicates the adversaries had no interest in that victim 3/4

It is important to clarify with potential victims whether they are simply detecting those remnants of possibly inert backdoor or if they have actually seen exfil of data 4/4