Microsoft unleashes 'Death Star' on SolarWinds hackers in extraordinary response to breach

[Ponietz]

104. Hi Nitram, I just read the latest Washington Post article

It is a horrifying scenario. Looks like they got into almost everything and there’s no short-term solution. The damage is probably ongoing, and will be into the indefinite future.

https://www.washingtonpost.com/business/technology/government-warns-new-hacking-tactics-russia/2020/12/17/bba43fd8-408c-11eb-a402-fba110db3b42_story.html

Purging the intruders and restoring security to affected networks could take months, some experts say, because the hackers moved rapidly from the initial intrusions through the corrupted software patches to collect and deploy authentic system credentials, making discovery and remediation far more difficult. Closing the digital back doors initially created by the Russians will not suffice because they appear to have stolen keys to an unknown number of official doorways into federal and private corporate systems, according to investigators at FireEye, a cybersecurity firm that also was hacked.

On Monday, Microsoft and FireEye diverted the channel the Russians used to send commands to systems that download the corrupted patch, causing the malware to shut down. But that does not help those organizations whose networks the Russians have deeply penetrated.
...
The Russian hackers are known for their stealth and ability to dwell at length inside compromised networks undetected. “My biggest concern would be if you’ve got an advanced adversary that has been in the network for a long time,” said Jack Wilmer, until August the Pentagon’s chief information security officer, who has no independent knowledge of the incident. “It may be very difficult to get them out and to be assured of the fact they’re no longer there.”