The US Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive, on December 13, in response to a known compromise involving SolarWinds Orion network management products that are currently being exploited by malicious actors.

The emergency directive calls on all federal civilian agencies to review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately.

“The compromise of SolarWinds’ Orion Network Management Products poses unacceptable risks to the security of federal networks,” said CISA Acting Director Brandon Wales. “Tonight’s directive is intended to mitigate potential compromises within federal civilian networks, and we urge all our partners—in the public and private sectors—to assess their exposure to this compromise and to secure their networks against any exploitation.”

The New York Times reported that the hack was "engineered by one of Russia’s premier intelligence agencies."

NYT also reported that US Treasury, Commerce, State and Homeland Security Departments, and parts of the Pentagon had been compromised.

According to Fireye, a cybersecurity company that was also targeted: "The actors behind this campaign gained access to numerous public and private organizations around the world. They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software. This campaign may have begun as early as Spring 2020 and is currently ongoing. Post compromise activity following this supply chain compromise has included lateral movement and data theft. The campaign is the work of a highly skilled actor and the operation was conducted with significant operational security."

Known affected products: Orion Platform versions 2019.4 HF 5 and 2020.2 with no hotfix or with 2020.2 HF 1, including:

Application Centric Monitor (ACM)

Database Performance Analyzer Integration Module (DPAIM)

Enterprise Operations Console (EOC)

High Availability (HA)

IP Address Manager (IPAM)

Log Analyzer (LA)

Network Automation Manager (NAM)

Network Configuration Manager (NCM)

Network Operations Manager (NOM)

Network Performance Monitor (NPM)

NetFlow Traffic Analyzer (NTA)

Server & Application Monitor (SAM)

Server Configuration Monitor (SCM)

Storage Resource Monitor (SCM)

User Device Tracker (UDT)

Virtualization Manager (VMAN)

VoIP & Network Quality Manager (VNQM)

Web Performance Monitor (WPM)

In a statement, Solarwinds said: "No other versions of Orion Platform products are known to be impacted by this security vulnerability. Other non-Orion products are also not known to be impacted by this security vulnerability."

Solarwinds asks customers with any of these products for Orion Platform v2020.2 with no hotfix or 2020.2 HF 1 to upgrade to Orion Platform version 2020.2.1 HF 1 as soon as possible.

SolarWinds also asks customers with any of these products for Orion Platform v2019.4 HF 5 to update to 2019.4 HF 6, available Dec. 14.

An additional hotfix release, 2020.2.1 HF 2 is anticipated to be made available Dec. 15. Solarwinds recommends that all customers update to release 2020.2.1 HF 2 once it is available, as the 2020.2.1 HF 2 release both replaces the compromised component and provides several additional security enhancements.

If you cannot upgrade immediately, the primary mitigation steps recommended by Solarwinds include having your Orion Platform installed behind firewalls, disabling internet access for the Orion Platform, and limiting the ports and connections to only what is necessary.