1. Home
  2. Software
  3. SUPERNOVA

SUPERNOVA

SUPERNOVA is an in-memory web shell written in .NET C#. It was discovered in November 2020 during the investigation of APT29's SolarWinds cyber operation but determined to be unrelated. Subsequent analysis suggests SUPERNOVA may have been used by the China-based threat group SPIRAL.[1][2][3][4][5]

ID: S0578
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 18 February 2021
Last Modified: 23 April 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.[1][2]
Enterprise T1203 Exploitation for Client Execution

SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).[6][7]
Enterprise T1036 .005 Masquerading: Match Legitimate Name or Location

SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.[1][2]
Enterprise T1027 Obfuscated Files or Information

SUPERNOVA contained Base64-encoded strings.[4]
Enterprise T1505 .003 Server Software Component: Web Shell

SUPERNOVA is a Web shell.[2][1][4]

References

  1. Riley, W. (2020, December 1). SUPERNOVA SolarWinds .NET Webshell Analysis. Retrieved February 18, 2021.
  2. Tennis, M. (2020, December 17). SUPERNOVA: A Novel .NET Webshell. Retrieved February 22, 2021.
  3. SolarWinds. (2020, December 24). SolarWinds Security Advisory. Retrieved February 22, 2021.
  4. CISA. (2021, January 27). Malware Analysis Report (AR21-027A). Retrieved February 22, 2021.
  1. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  2. Carnegie Mellon University. (2020, December 26). SolarWinds Orion API authentication bypass allows remote command execution. Retrieved February 22, 2021.
  3. Stoner, J. (2021, January 21). Detecting Supernova Malware: SolarWinds Continued. Retrieved February 22, 2021.