{"id":18704,"date":"2021-01-12T19:28:34","date_gmt":"2021-01-12T16:28:34","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=18704"},"modified":"2026-03-27T20:12:15","modified_gmt":"2026-03-27T17:12:15","slug":"a-kazual-sunburst-the-missing-link-experts-connect-solarwinds-attack-with-kazuar-backdoor","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/a-kazual-sunburst-the-missing-link-experts-connect-solarwinds-attack-with-kazuar-backdoor\/","title":{"rendered":"A Kazual Sunburst – the missing link: experts connect SolarWinds attack with Kazuar backdoor"},"content":{"rendered":"\n
\n
\u0639\u0631\u0628\u064a<\/a><\/div>\n<\/div>\n\n\n\n

On December 13, 2020, FireEye, Microsoft, and SolarWinds\u00a0<\/strong>anno<\/strong><\/a>unced\u00a0the discovery of a large, sophisticated supply chain attack that deployed a new, previously unknown malware, \u201cSunburst,\u201d used against SolarWinds\u2019 Orion IT customers. Kaspersky\u2019s experts found various specific code similarities between Sunburst and known versions of Kazuar backdoors \u2013 the type of malware that provides remote access to a victim\u2019s machine. The new findings provide insights that can help the researchers move forward in the investigation of the attack.<\/strong><\/p>\n\n\n\n

While studying the Sunburst backdoor Kaspersky\u2019s experts discovered several features that overlap with a previously identified Kazuar, a backdoor written using the .NET framework first\u00a0report<\/a>ed by Palo Alto in 2017\u00a0and used in the cyberespionage attacks across the globe. Multiple similarities in code suggest a connection between Kazuar and Sunburst, albeit of undetermined nature.\u00a0<\/p>\n\n\n\n

The overlapped features between Sunburst and Kazuar\u00a0include the victim UID generation algorithm, the sleeping algorithm, and the FNV-1a hash’s extensive usage. According to the experts, these code fragments are not 100% identical, suggesting\u00a0Kazuar and Sunburst may be related, though the nature of this relation is still not entirely clear.\u00a0<\/p>\n\n\n\n

After the Sunburst malware was first deployed in February 2020, Kazuar continued to evolve, and later 2020 variants are even more similar in some respect to Sunburst.\u00a0<\/p>\n\n\n\n

Overall, during the years of Kazuar evolution, the experts observed a continuous development in which significant features that bear a resemblance to Sunburst were added. While these similarities between Kazuar and Sunburst are notable, there could be a lot of reasons for their existence, including Sunburst being developed by the same group as Kazuar, Sunburst developers using Kazuar as an inspiration point, the move of one of Kazuar developers to the Sunburst team, or both groups behind Sunburst and Kazuar having obtained their malware from the same source.<\/p>\n\n\n\n

\u201cThe identified connection does not give away who was behind the SolarWinds attack. However, it provides more insights that can help the researchers move forward in this investigation. We believe it\u2019s important that other researchers worldwide investigate these similarities and attempt to discover more facts about Kazuar and the origin of Sunburst, the malware used in the SolarWinds breach. Judging from experience, for instance, looking back to the WannaCry attack, there were very few facts linking them to the Lazarus group in the early days. In time, more evidence appeared and allowed us, and others, to link them together with high confidence. Further research on this topic is crucial for connecting the dots,\u201d\u00a0<\/em>comments Costin Raiu, director of Kaspersky\u2019s Global Research and Analysis Team.<\/p>\n\n\n\n

Learn more technical details about Sunburst and Kazuar similarities in the report on\u00a0Sec<\/a>urelist.\u00a0\u00a0Read more on Kaspersky\u2019s research about Sunburst\u00a0here\u00a0and learn how Kaspersky protects its\u2019 customers against the Sunburst backdoor.<\/p>\n\n\n\n

To avoid risks of being infected by malware such as the Sunburst backdoor, Kaspersky recommends:<\/p>\n\n\n\n