{"id":411863,"date":"2021-01-11T08:03:20","date_gmt":"2021-01-11T13:03:20","guid":{"rendered":"http:\/\/www.marketnewsdesk.com\/?p=411863"},"modified":"2021-01-11T08:03:20","modified_gmt":"2021-01-11T13:03:20","slug":"kaspersky-experts-connect-solarwinds-attack-with-kazuar-backdoor","status":"publish","type":"post","link":"https:\/\/www.marketnewsdesk.com\/index.php\/kaspersky-experts-connect-solarwinds-attack-with-kazuar-backdoor\/","title":{"rendered":"Kaspersky experts connect SolarWinds attack with Kazuar backdoor"},"content":{"rendered":"
\n

Woburn, MA, Jan. 11, 2021 (GLOBE NEWSWIRE) — On December 13, 2020, FireEye, Microsoft and SolarWinds announced<\/a> the discovery of a large, sophisticated supply chain attack that deployed a new, previously unknown malware, Sunburst, against SolarWinds\u2019 Orion IT customers. Today, Kaspersky<\/a> announced that its experts found various specific code similarities between Sunburst and known versions of Kazuar backdoors \u2013 malware that provides remote access to a victim\u2019s machine. The new findings provide insights<\/a> that can help researchers move forward in the investigation of the attack.<\/p>\n

While studying the Sunburst backdoor, Kaspersky experts discovered a number of features that overlap with Kazuar, which has been previously identified as a backdoor written using the .NET framework. It was first reported by Palo Alto in 2017<\/a> and used in cyber-espionage attacks across the globe. Multiple similarities in code suggest a connection between Kazuar and Sunburst, albeit of an undetermined nature.<\/p>\n

The overlapping features between Sunburst and Kazuar include the victim UID generation algorithm, the sleeping algorithm and the extensive usage of the FNV-1a hash. According to the experts, these code fragments are not 100% identical, suggesting Kazuar and Sunburst may be related, though the nature of this relation is still not entirely clear.<\/p>\n

After the Sunburst malware was first deployed in February 2020, Kazuar continued to evolve and later 2020 variants are even more similar, in some respects, to Sunburst.<\/p>\n

Overall, during the years of Kazuar\u2019s evolution, the experts observed continuous development, in which significant features bearing resemblance to Sunburst were added. While these similarities between Kazuar and Sunburst are notable, there could be a lot of reasons for their existence, including Sunburst being developed by the same group as Kazuar, Sunburst\u2019s developers using Kazuar as inspiration, a Kazuar developer moving to the Sunburst team or both groups behind Sunburst and Kazuar having obtained their malware from the same source.<\/p>\n

\u201cThe identified connection does not give away who was behind the SolarWinds attack, however, it provides more insights that can help researchers move forward in this investigation,\u201d said Costin Raiu, director of Kaspersky\u2019s Global Research and Analysis Team. \u201cWe believe it\u2019s important that other researchers around the world investigate these similarities and attempt to discover more facts about Kazuar and the origin of Sunburst, the malware used in the SolarWinds breach. Judging from past experience, for instance, looking back to the WannaCry attack, in the early days, there were very few facts linking it to the Lazarus group. In time, more evidence appeared and allowed us, and others, to link them together with high confidence. Further research on this topic will be crucial for connecting the dots.\u201d<\/p>\n

Learn more technical details about the similarities between Sunburst and Kazuar in this report on Securelist<\/a>. Read more Kaspersky research about Sunburst here<\/a> and learn how Kaspersky protects its customers against the Sunburst backdoor here<\/a>.<\/p>\n

To avoid risks of being infected by malware such as the Sunburst backdoor, Kaspersky recommends:<\/p>\n