Solar Winds Security Advisory & Hotfix Link: https://www.solarwinds.com/securityadvisory

This was a highly sophisticated supply chain compromise that deployed a piece of malware being tracked as SUNBURST. FireEye has released several rules to detect the IOC’s in the environment. If hot fixing the affecting product is not possible, there are several other options:

• Disconnect or power down affected SolarWinds Orion Products
• Block SolarWinds hosts from communicating with external addresses until the patch can be applied.

As a precaution, Datashield recommends performing the following actions:

• Resetting all credentials used by the SolarWinds software
• Reset all admin credentials who utilized SolarWinds software
• Rebuild SolarWinds Orion hosts

We will keep you updated with any relevant information as this incident progresses. Additional links and information are below:

• DHS Actions 
• FireEye Article