Navigating the SolarStorm Attack — We are Here to Help

[agalindo]

Palo Alto Networks Rapid Response: Navigating the SolarStorm Attack

Last updated January 21, 2021

With the news about the SolarWinds supply chain attack, we want to let you know that we are here to help and want to make sure you have all the resources and information you need.

What is the SolarWinds Supply Chain Attack? 

For those who may not have heard, we recently learned about the campaign of attacks connected to a suspected nation state actor behind the SolarWinds SUNBURST malware, which we've named the SolarStorm attack.

Ensuring Your Protection is Our Top Priority

Here’s how Palo Alto Networks can help ensure you’re protected from these attacks. We are here to help you better understand and defend against this threat, which is why we’ve put together two different programs:

1. SolarStorm Rapid Assessment: This free assessment assesses whether you’ve been compromised. Our team will help you locate the at-risk servers by your organization and provide you with a SolarStorm Assessment Report. Take the free assessment here.
2. SolarStorm Initial CyberSecure Engagement: If you believe that you’ve been exposed, don’t worry we can help you directly engage with an expert team dedicated to this program. This expert will do a full investigation and remediation of the incident. Connect with an expert here.

Understanding the SolarStorm Threat: 

We understand that you might have questions about this attack and how it can potentially impact you. You can watch this video where Palo Alto Networks leaders discussed the impact of SolarStorm and how it differs from other attacks.

Unit 42, our global threat intelligence team also put together this threat brief, tracking the SolarWinds attack. They also provide instructions on how to identify whether your organization has been compromised using the Palo Alto Networks Next Generation Firewall, Cortex XDR and XSOAR, as well as additional resources and indicators of compromise. Read the report here.

You can learn more about the timeline perspective of the SolarStorm Supply-Chain attack in this Unit 42 blog where they also include some additional resources around their latest research.

Upcoming LinkedIn Live Series - Navigating the current and future “SolarStorms”:

We are always thinking about the future, which is why it’s important to have a discussion beyond Solarwinds or any specific type of malware, and start talking about the broader strategies and risks associated with advanced threat actors. Linkedin Live is where Palo Alto Networks leaders and industry experts will be talking about how to assess your exposure in the wake of the SolarStorm attack and what steps you can take to future-proof yourself. Here are the upcoming webinars:

• Topic: Establishing a Complete and Accurate View of Your Infrastructure
  • Date: January 6, 2021
  • Time: 9AM PST
• Topic: Making Your Security Data Work for You
  • Date: January 12, 2021
  • Time: 9AM PST

Let us know in the comment section down below which webinar you plan on attending!

Upcoming Unit 42 SolarStorm Webinar Briefings

Unit 42 will be hosting a series of webinars focused around the SolarStorm Attack. Ryan Olson, VP of Threat Intelligence here at Palo Alto Networks, will share some countermeasures you can take today to help protect your organization. He will also cover information about the Palo Alto Networks Response program and how it can help your organization assess and remediate risks related to SolarWinds. Here are some of the upcoming webinars:

• Date: December 23, 2020
  • Time: 2pm ET
  • Register here
• Date: January 7, 2020
  • Time: 10am CT
  • Register here

For those who weren’t able to attend the Unit 42 Solarstorm webinar briefing above, you can now watch it on-demand here.

 

Cortex Resources for SolarStorm

• Cortex XSOAR Rapid Response Playbook 
• This playbook can help speed up the discovery of the SolarWind installations within your networks and also uncover signs of a potential threat. 
• Video - Cortex XDR SolarStorm Impact Reports
• Expanse Reveals SolarWinds Breach and Attacker Communications 

A message of our commitment from Nikesh Arora

As a community, your feedback is important to us, so we started a discussion around these events where you can engage and discuss this topic amongst your peers, share your thoughts and find out what others are thinking, and provide your input about the topic.

Know that we are by your side and supporting you. If you want to learn more about how Palo Alto Networks can help, visit our Rapid Response resource page.