Threat Intelligence Tarot
cups · 12
Russia (SVR-linked)
★★★★★
risk 5/5
✦ The Supply Chain Reader ✦
SilverFish
TEMP.Isotope
SolarWinds victimsUS federal agenciesEuropean governmentEnergy sector
Active since ~2020 · Post-SolarWinds exploitation, Secondary supply chain access, Western government espionage
While UNC2452 deployed SUNBURST through the SolarWinds update, SilverFish was inside SolarWinds itself - monitoring the build environment, reading victim data as it flowed through the supply chain, watching 4,700 organizations from a single vantage point inside the update pipeline.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Secondary exploitation of SolarWinds victim networks (2020–2021)
- ◆SUNSPOT implant on SolarWinds build system
- ◆Access to 4,700+ victim environments at peak
- ◆Coordinated with UNC2452 SolarWinds operations
Defenses
- ▸Software build pipeline integrity monitoring and signingNIST CSF: ID.SC ↗
- ▸OAuth token audit and conditional access enforcementCIS Control 6 ↗
- ▸Privileged identity management for build and deployment systemsCIS Control 5 ↗
- ▸Zero-trust lateral movement controls for cloud environmentsCISA Zero Trust Maturity
Reversed: Their Weakness
The SolarWinds compromise's discovery triggered one of the most extensive threat-hunting operations in corporate history - while SilverFish had exceptional access, the forensic response it triggered permanently hardened software supply chain practices industry-wide.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.