SEC still digging into SolarWinds fallout, nudges undeclared victims
(2021/06/23)
- Reference: 1624401908
- News link: https://www.theregister.co.uk/2021/06/22/sec_continues_to_probe_solarwinds/
- Source link:
US markets watchdog the Securities and Exchanges Commission (SEC) has begun a probe into last year's SolarWinds cyberattack, in a bid to find out who else might have been compromised.
Unnamed sources familiar with the investigation [1]have told Reuters the US financial regulator recently sent out letters to businesses seeking clarification, amid concerns that not everyone has come clean.
The news agency also said the SEC is keen to know whether "public companies that had been victims had experienced a lapse of internal controls, and related information on insider trading", which could also involve issues around data protection.
[2]
SolarWinds is the maker of the Orion network infrastructure monitoring platform which was [3]compromised last year , with miscreants apparently romping through some 18,000 of SolarsWinds' Origin customers' servers using malware installed via an update server.
[4]
[5]Microsoft president Brad Smith called it "the largest and most sophisticated attack the world has ever seen," and said his firm's analysis suggested the code behind the crack was the work of 1,000 or more developers.
Among other exploits, the wrong'uns apparently gained access to the networks of multiple US government departments via backdoored IT tools, including the US court system and its [6]nuclear weapons agency , as well as managing to inject malware onto Microsoft's own systems. At the end of last year, Microsoft [7]confirmed it had "detected malicious Solar Winds binaries in our environment, which we isolated and removed."
[8]
No one from the SEC was available for comment at the time of writing, although El Reg was interested to read that the market and securities watchdog recently [9]paid out $5.3m to whistleblowers in two separate cases for providing "information and assistance in separate enforcement proceedings."
[10]Biden to Putin: Get your ransomware gangs under control and don’t you dare cyber-attack our infrastructure
[11]Feds seize two domains used by SolarWinds intruders for malware spear-phishing op
[12]Russian gang behind SolarWinds hack returns with phishing attack disguised as mail from US aid agency
[13]Here's what Russia's SVR spy agency does when it breaks into your network, says US CISA infosec agency
Russia [14]has denied any involvement in the attack, although it obviously would do. ®
Get our [15]Tech Resources
[1] https://www.reuters.com/technology/us-sec-official-says-agency-has-begun-probe-cyber-breach-by-solarwinds-2021-06-21/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNKx5EYBXZHqmVbBaGwDzgAAABY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2020/12/21/in_brief_security/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNKx5EYBXZHqmVbBaGwDzgAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/02/15/solarwinds_microsoft_fireeye_analysis/
[6] https://www.theregister.com/2020/12/18/solarwinds_nnsa_microsoft_cisa/
[7] https://www.theregister.com/2020/12/18/solarwinds_nnsa_microsoft_cisa/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNKx5EYBXZHqmVbBaGwDzgAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.sec.gov/news/press-release/2021-106
[10] https://www.theregister.com/2021/06/17/biden_putin_summit_cybersecurity_discussion/
[11] https://www.theregister.com/2021/06/02/feds_seize_nobelium/
[12] https://www.theregister.com/2021/05/28/solar_winds_attacker_nobelium_returns/
[13] https://www.theregister.com/2021/04/27/apt29_russia_svr_tactics_cisa/
[14] https://www.theregister.com/2021/05/18/russian_spymaster_solarwinds/
[15] https://whitepapers.theregister.com/
Unnamed sources familiar with the investigation [1]have told Reuters the US financial regulator recently sent out letters to businesses seeking clarification, amid concerns that not everyone has come clean.
The news agency also said the SEC is keen to know whether "public companies that had been victims had experienced a lapse of internal controls, and related information on insider trading", which could also involve issues around data protection.
[2]
SolarWinds is the maker of the Orion network infrastructure monitoring platform which was [3]compromised last year , with miscreants apparently romping through some 18,000 of SolarsWinds' Origin customers' servers using malware installed via an update server.
[4]
[5]Microsoft president Brad Smith called it "the largest and most sophisticated attack the world has ever seen," and said his firm's analysis suggested the code behind the crack was the work of 1,000 or more developers.
Among other exploits, the wrong'uns apparently gained access to the networks of multiple US government departments via backdoored IT tools, including the US court system and its [6]nuclear weapons agency , as well as managing to inject malware onto Microsoft's own systems. At the end of last year, Microsoft [7]confirmed it had "detected malicious Solar Winds binaries in our environment, which we isolated and removed."
[8]
No one from the SEC was available for comment at the time of writing, although El Reg was interested to read that the market and securities watchdog recently [9]paid out $5.3m to whistleblowers in two separate cases for providing "information and assistance in separate enforcement proceedings."
[10]Biden to Putin: Get your ransomware gangs under control and don’t you dare cyber-attack our infrastructure
[11]Feds seize two domains used by SolarWinds intruders for malware spear-phishing op
[12]Russian gang behind SolarWinds hack returns with phishing attack disguised as mail from US aid agency
[13]Here's what Russia's SVR spy agency does when it breaks into your network, says US CISA infosec agency
Russia [14]has denied any involvement in the attack, although it obviously would do. ®
Get our [15]Tech Resources
[1] https://www.reuters.com/technology/us-sec-official-says-agency-has-begun-probe-cyber-breach-by-solarwinds-2021-06-21/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNKx5EYBXZHqmVbBaGwDzgAAABY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2020/12/21/in_brief_security/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNKx5EYBXZHqmVbBaGwDzgAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/02/15/solarwinds_microsoft_fireeye_analysis/
[6] https://www.theregister.com/2020/12/18/solarwinds_nnsa_microsoft_cisa/
[7] https://www.theregister.com/2020/12/18/solarwinds_nnsa_microsoft_cisa/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNKx5EYBXZHqmVbBaGwDzgAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.sec.gov/news/press-release/2021-106
[10] https://www.theregister.com/2021/06/17/biden_putin_summit_cybersecurity_discussion/
[11] https://www.theregister.com/2021/06/02/feds_seize_nobelium/
[12] https://www.theregister.com/2021/05/28/solar_winds_attacker_nobelium_returns/
[13] https://www.theregister.com/2021/04/27/apt29_russia_svr_tactics_cisa/
[14] https://www.theregister.com/2021/05/18/russian_spymaster_solarwinds/
[15] https://whitepapers.theregister.com/