The newly appointed chief executive of SolarWinds Corp. SWI -1.93% is still trying to unravel how his company became a primary vector for hackers in a massive attack revealed last year, but said evidence is emerging that they were lurking in the company’s Office 365 email system for months.
The hackers had accessed at least one of the company’s Office 365 accounts by December 2019, and then leapfrogged to other Office 365 accounts used by the company, Sudhakar Ramakrishna said in an interview Tuesday. “Some email accounts were compromised. That led them to compromise other email accounts and as a result our broader [Office] 365 environment was compromised,” he said.
It is the latest development in the eight-week investigation into one of the worst breaches in U.S. history. SolarWinds, previously a little-known but critical maker of network-management software, is still trying to understand how the hackers first got into the company’s network and when exactly that happened.
One possibility is that the hackers may have compromised the company’s Office 365 accounts even earlier and then used that as the initial point of entry into the company, although that is one of several theories being pursued, Mr. Ramakrishna said.
More on the SolarWinds Hack
Investigators are trying to determine how widespread the damage has been. So far only several dozen victims have been identified, but the attack could have ultimately affected close to 18,000 of the company’s customers.
The internal investigation has involved searching through tens of terabytes of logfiles and other data in an effort to retrace the steps of a hacking operation that went undetected for more than a year, Mr. Ramakrishna said. “We have been evaluating mountains of data,” he said.
Ultimately the response to the incident will end up costing SolarWinds millions of dollars, said Mr. Ramakrishna, who had been pegged as SolarWinds next chief executive when the hack was discovered, but didn’t start at the company until Jan. 4.
“My attitude was to come in and assess first and figure out what we needed to do,” he said. Since taking over, Mr. Ramakrishna has revamped the company’s software development processes and brought in outside cybersecurity experts to help respond to the breach, including Chris Krebs, formerly the Department of Homeland Security’s top cybersecurity official, and Alex Stamos, formerly Facebook’s chief security officer.
Investigators describe the hack as one of the worst in U.S. history because of its sophistication, scope and the way it undermined the trusted relationship between technology providers and the products they make.
The attackers crafted a way to turn SolarWinds’ own software update into a kind of digital Trojan horse. So far, the investigation has found that the hackers were running tests on SolarWinds’ internal build systems, used to assemble the company’s software updates, in September 2019. The build system was then used to create a malicious software patch that SolarWinds says it shipped out to fewer than 18,000 customers in 2020.
The U.S. government has publicly blamed Russia, which has denied responsibility. Last month, President Biden instructed his director of national intelligence, Avril Haines, to conduct a review of Russian aggression against the U.S., including the SolarWinds hack.
Dozens of SolarWinds’ customers, including major technology companies such as Microsoft Corp. and Cisco Systems Inc., were affected by the incident, as well as the departments of the Treasury, Justice, Energy, Commerce, State, Homeland Security, Labor and Energy.
On Tuesday, people familiar with the investigation said that another group of hackers—a group linked to China—that had accessed the Agriculture Department’s networks, exploited an unrelated and less serious flaw in SolarWinds software to further target the organization’s computer systems. The Agriculture Department attack was reported earlier by Reuters. A spokesman for the Agriculture Department disputed aspects of the Reuters story but didn’t clarify whether any part of the department had suffered a breach related to SolarWinds software.
Mr. Ramakrishna said that SolarWinds was already investigating a single report of hackers exploiting this bug when it learned of its own compromise last December.
While SolarWinds’ network management software, called Orion, was itself a major avenue of attack by the hacking effort, it wasn’t the only one. Last week the acting director of the Cybersecurity and Infrastructure Security Agency said that about 30% of the hackers’ victims had no direct connection with SolarWinds itself.
“This is a pretty significant incident,” said Adam Meyers, senior vice president of intelligence at CrowdStrike Holdings Inc., a security company that SolarWinds hired to investigate the hack. “Frankly I don’t even know that we’ve scratched the surface on this thing.”
—Dustin Volz contributed to this article.
Write to Robert McMillan at [email protected]
Copyright ©2020 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8
