ALT-42 · Analysis · 23 Oct 2026
SolarWinds: the build server as the front door
A backdoor was compiled into signed updates of a widely used network monitoring product and shipped to some 18,000 customers. The quietest major supply-chain compromise on record, and what it taught about build systems.
- Sep 2019Attackers first access SolarWinds' network, according to the company.
- Mar–Jun 2020Trojanised Orion updates are shipped.
- 13 Dec 2020Public disclosure; CISA issues Emergency Directive 21-01.
- Apr 2021The US formally attributes the campaign to the SVR.
- Customers that installed affected Orion versions
- <18,000SolarWinds, SEC Form 8-K (Dec 2020)
How it got in
A separate implant, SUNSPOT, sat on the build server and swapped a source file only during compilation. The repository stayed clean; reviewers saw nothing. The resulting update was signed and distributed by SolarWinds' normal process.
SUNBURST waited up to two weeks before acting, disguised its traffic as Orion's own protocol and checked for security tools before calling home.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Signing proves who shipped a binary, not what went into it.
- Build infrastructure needs the protection of production, or more.
- Network-monitoring tools have privileged access everywhere — they are high-value targets.
What to do
- Make builds reproducible and verify them on independent infrastructure.
- Restrict outbound connections from management and monitoring servers.
- Treat build servers as tier-0 assets: isolated, monitored, rebuilt from scratch.
Sources
- CISA — Emergency Directive 21-01
- SolarWinds — SEC Form 8-K (14 Dec 2020)
- CrowdStrike — SUNSPOT: an implant in the build process
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-42 — SolarWinds: the build server as the front door. 23 Oct 2026. altumptic.com/research/solarwinds-2020