Russian SVR Exploits SolarWinds and Other Vulnerabilities Against U.S. Networks

www.gao.gov

Russian SVR Exploits SolarWinds and Other Vulnerabilities Against U.S. Networks

First seen 24 May 2026, 23:30 UTC •80.0

Article Content

1 / 3

Browse articles

ThreatCluster •May 25, 2026 at 23:02 UTC

•The SolarWinds breach affected approximately 18,000 customers, including federal agencies.
•SVR is exploiting multiple known vulnerabilities, including those in VMware products.
•U.S. agencies have issued advisories urging immediate action to mitigate these threats.

The Russian Foreign Intelligence Service (SVR) has been exploiting multiple vulnerabilities, including the SolarWinds breach, to compromise U.S. and allied networks. The SolarWinds attack, which began in September 2019, involved the insertion of trojanized code into software updates, affecting nearly 18,000 customers, including federal agencies. The SVR has also targeted COVID-19 research facilities and exploited other vulnerabilities such as those in VMware products. The NSA, CISA, and FBI have issued advisories to mitigate these threats and encourage network defenders to check for indicators of compromise. The ongoing exploitation of these vulnerabilities poses a significant risk to national security and critical infrastructure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 143d ago How this analysis works

Timeline

2019-09-01

SolarWinds cyberattack initiated

The Russian SVR began a campaign to breach SolarWinds' software, leading to widespread exploitation.

2020-02-01

Trojanized code injected into SolarWinds updates

The SVR injected malicious code into the Orion software updates, compromising customer systems.

2020-11-01

FireEye detects SolarWinds compromise

FireEye reported an intrusion into its systems, leading to the discovery of the SolarWinds breach.

2026-05-24

Joint Cybersecurity Advisory released

NSA, CISA, and FBI released an advisory detailing ongoing SVR exploitation of known vulnerabilities.

More articles in this cluster (2)

Threat Graph

10 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Supply Chain Attack
Trojan
T1078 - Valid Accounts
T1195 - Supply Chain Compromise

Organization (3)

FireEye
Microsoft
SolarWinds

Malware (1)

WellMess

Affected Platform (1)

Workspace ONE Access

Tool (1)

VMware

Relationships

WellMess targets FireEye
WellMess targets Microsoft
WellMess targets SolarWinds
Supply Chain Attack targets Workspace ONE Access
Trojan targets Workspace ONE Access
T1078 - Valid Accounts targets Workspace ONE Access
T1195 - Supply Chain Compromise targets Workspace ONE Access
WellMess related to VMware

Following this threat?

Track WellMess and FireEye in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…