Case Study SolarWinds Related DNS Indicators

The SolarWinds breach, one of the most significant cyber espionage incidents in recent history, exposed sophisticated techniques used by advanced persistent threat actors to infiltrate high-profile organizations through a compromised software supply chain. A key aspect of the attackers’ operational security and command-and-control infrastructure involved carefully crafted DNS activity that served as an early indicator of compromise. Forensic analysis of DNS telemetry related to SolarWinds revealed subtle but highly specific patterns that, when properly understood, allowed investigators to trace attacker movements, identify compromised systems, and develop indicators of compromise (IOCs) for broader defense efforts.

The initial stage of the SolarWinds compromise hinged on the implantation of a sophisticated malware backdoor known as SUNBURST into SolarWinds Orion updates. Once installed, SUNBURST would lie dormant for up to two weeks to evade detection before initiating its first network communications. Crucially, these communications were DNS-based. Instead of immediately contacting an overt command-and-control server via HTTP or HTTPS, the malware first used DNS queries to exfiltrate limited reconnaissance information and retrieve further instructions.

SUNBURST-generated DNS queries displayed distinct characteristics that forensic analysts were able to use for detection. Each compromised host would generate subdomain queries where the subdomain itself was constructed from encoded and compressed device-specific information. The full query typically looked like a long, random string followed by a domain under attacker control, specifically avsvmcloud.com. For example, a query might take the form of something like kjdhg34lsdflk34sdf.avsvmcloud.com. Analysts noted that the entropy of these subdomains was extremely high, with random-looking strings significantly longer than what would normally be expected in a legitimate DNS query.

Another critical indicator was the pattern of DNS requests. Compromised hosts issued queries with unusual periodicity, carefully timed to blend in with normal background noise but distinct from typical application behaviors. Furthermore, the SUNBURST malware used a domain generation-like algorithm to vary the subdomains slightly over time, complicating simple string matching detections but still falling into identifiable patterns when entropy, string length, and query frequency were profiled collectively.

The parent domain avsvmcloud.com itself became a critical IOC. Forensic investigators at FireEye, Microsoft, and other organizations identified this domain as being the central hub for SUNBURST’s DNS-based communications. Passive DNS datasets were instrumental in mapping the spread of infection, allowing analysts to observe which organizations’ networks had devices making outbound queries to avsvmcloud.com during the compromised time window. This passive telemetry provided visibility into potential victims even in cases where endpoint detection had not yet flagged anomalies.

Deeper forensic inspection revealed that the malware used DNS responses to dictate behavior dynamically. If the attacker-controlled name server resolved the avsvmcloud.com query with specific IP addresses associated with non-routable private address space, such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16, the malware would disable its own network activity to avoid detection. If, however, a routable IP was returned, the malware would proceed to establish full HTTP-based communications with secondary command-and-control domains. This behavior highlighted the critical command signaling role that DNS responses played in the SolarWinds operation.

Investigators also discovered secondary domains associated with later-stage payload delivery and command-and-control activity, often masquerading under benign-looking names and hosted on compromised infrastructure or legitimate cloud services. These included domains such as freescanonline.com, deftsecurity.com, and other ephemeral domains used once a victim was elevated for further exploitation. Each of these domains was involved in receiving initial beacons, exfiltrating victim profiling information, and deploying customized second-stage malware.

From a forensic standpoint, identifying the temporal sequence of DNS interactions was essential to understanding the attacker’s workflow. Analysts reconstructed timelines showing that compromised hosts often issued multiple DNS queries to avsvmcloud.com over the course of days or weeks, punctuated by shifts to HTTP traffic to secondary domains once the attackers decided to operationalize a given victim. This allowed responders to distinguish between passive compromises where no further action was taken and active compromises where deeper infiltration occurred.

Correlation with TLS telemetry further enriched the forensic picture. Although initial contact was DNS-based, eventual secondary communications relied on HTTPS connections with suspicious certificate characteristics, including self-signed certificates or certificates issued shortly before the attacks. By mapping the overlap between suspicious DNS queries and anomalous TLS connections, investigators could more confidently attribute outbound traffic to SUNBURST activity rather than legitimate business operations.

The SolarWinds case also demonstrated the importance of combining DNS forensic evidence with endpoint telemetry. On compromised machines, forensic artifacts such as DNS cache entries, system event logs, Orion application logs, and memory-resident indicators provided additional confirmation of malicious activity. Forensic imaging of affected systems often revealed traces of the SUNBURST malware DLL loaded into memory, scheduled task creations, or suspicious process trees initiated as a result of the backdoor’s operation.

Legal and operational consequences of the DNS indicators were profound. Once the DNS infrastructure was identified, domain seizures and sinkholing operations were carried out to halt the spread of the malware and gather intelligence on infected systems. By sinkholing avsvmcloud.com, responders were able to safely redirect beaconing traffic to controlled servers, cataloging affected systems while preventing the attackers from issuing further commands.

Ultimately, the forensic dissection of DNS indicators related to the SolarWinds breach underscored the strategic value of DNS monitoring, passive data aggregation, and behavioral analytics in detecting sophisticated threats. It highlighted how adversaries, even those operating at nation-state levels, leave traces within the ostensibly mundane realm of DNS that, when correctly interpreted, provide a vital early warning system. The lessons learned from SolarWinds continue to inform modern detection strategies, emphasizing the necessity of continuous DNS visibility, entropy-based anomaly detection, and rapid cross-correlation between network and endpoint evidence in the fight against advanced persistent threats.

The SolarWinds breach, one of the most significant cyber espionage incidents in recent history, exposed sophisticated techniques used by advanced persistent threat actors to infiltrate high-profile organizations through a compromised software supply chain. A key aspect of the attackers’ operational security and command-and-control infrastructure involved carefully crafted DNS activity that served as an early indicator…