Trend data on the SolarWinds Orion compromise

Supply-Chain Attack on SolarWinds Orion: The DNS Indicators

FireEye's December 13 report detailed a sophisticated supply-chain compromise of SolarWinds' Orion IT monitoring platform. Attackers managed to push malware to Orion customers through normal software updates, with the malicious payload carrying a valid digital signature. The initial infection vector was notable, but the network communications layer of the malware is equally intricate, relying on multiple stages to obscure its command and control (C2) traffic.

A Multi-Stage DNS Trick

The malware first establishes contact with its C2 infrastructure using a domain generation algorithm (DGA). It constructs a random string and prepends it as a subdomain to one of several fixed parent domains, which all resolve under avsvmcloud[.]com. The known parent domains include:

.appsync-api[.]eu-west-1[.]avsvmcloud[.]com.appsync-api[.]us-west-2[.]avsvmcloud[.]com.appsync-api[.]us-east-1[.]avsvmcloud[.]com.appsync-api[.]us-east-2[.]avsvmcloud[.]com

A typical query would look like hig4gcdkgjkrt24v6isue7ax09nksd[.]appsync-api[.]eu-west-1[.]avsvmcloud[.]com. The DNS response to these DGA-generated subdomains returns a CNAME record pointing to a second-tier C2 domain used for data exfiltration. The following domains were identified as the actual staging grounds for stolen data:

freescanonline[.]comdeftsecurity[.]comthedoccloud[.]comwebsitetheme[.]comhighdatabase[.]comincomeupdate[.]comdatabasegalore[.]companhardware[.]comzupertech[.]comvirtualdataserver[.]comdigitalcollege[.]org

Observations from the 1.1.1.1 Resolver

Analyzing query volume to these known malicious hostnames through Cloudflare's public DNS resolver, a clear timeline of the attack emerges. Because 1.1.1.1 operates under a strict, audited privacy policy, individual source IPs are not visible—only aggregated trends.

Query traffic to avsvmcloud[.]com began to spike in April 2020.

The DGA pattern—{dga-string}[.]appsync-api[.]{region}[.]avsvmcloud[.]com—was identifiable as early as April, with the number of unique generated subdomains growing steadily over the following months.

Activity rose sharply through the summer, with the total volume of observed subdomains hitting a steady state by September.

While the rate of new domain generation slowed in October, the geographic source of the queries continued to shift throughout the campaign. Early traffic came almost exclusively from North America and Europe. By May, the queries originated from a broader global footprint. In July, the bulk of activity shifted to South America before returning primarily to North America in November.

Detection and Response for Managed DNS Customers

Cloudflare's privacy stance on the public resolver means it cannot alert specific users of a potential compromise—the service intentionally does not retain the data required to identify them. For customers on Cloudflare Gateway, the situation is different.

Gateway's DNS filtering is built on the same technology as 1.1.1.1 but adds logging and security controls. In the wake of the FireEye disclosure, Cloudflare blocked access to the identified C2 domains for Gateway customers using the "Malware" category, as well as for users of the 1.1.1.1 for Families service (resolvers 1.1.1.2 and 1.1.1.3).

The response team is working with Gateway customers to review DNS query logs for any traffic to the malicious domains. Customers can also export their logs independently to conduct their own investigations.