Case Study: SolarWinds uncovers SUNBURST attack activity with Maltego and Farsight DNSDB

SolarWinds investigates SUNBURST with Maltego using 100B+ historical DNS records

SolarWinds, a major provider of IT management software, faced an immense challenge following the discovery of the sophisticated SUNBURST supply chain attack. The compromise affected thousands of its customers and, after Microsoft took over the malicious command and control domain, conventional investigative tools could no longer uncover the full scope of the attack or map its historical patterns. To investigate this hidden activity, they turned to Maltego and its integration with Farsight DNSDB historical passive DNS data.

Maltego provided the solution by enabling investigators to use Farsight’s Flexible Search Transforms to retrieve historical DNS records and analyze domain patterns related to the attack. This allowed analysts to identify which subdomains had been resolved to specific IP addresses and evaluate the potential scale of the SUNBURST compromise, uncovering C2 communications that occurred before the attack was public knowledge. The use of Maltego's link analysis combined with this historical data was crucial for mapping the malicious activity that had otherwise disappeared from the internet.

SolarWinds