{"id":208392,"date":"2021-01-07T19:44:10","date_gmt":"2021-01-07T18:44:10","guid":{"rendered":"https:\/\/www.stormshield.com\/?p=208392"},"modified":"2024-04-08T14:01:09","modified_gmt":"2024-04-08T13:01:09","slug":"alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield","status":"publish","type":"post","link":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/","title":{"rendered":"Malware Sunburst : \u00e9tat des lieux d\u2019une attaque avanc\u00e9e et mesures de protection avec Stormshield"},"content":{"rendered":"<p><strong>Le 8 d\u00e9cembre 2020, la soci\u00e9t\u00e9 am\u00e9ricaine FireEye publiait un communiqu\u00e9 de presse dans lequel elle d\u00e9clarait \u00eatre victime d\u2019un malware, baptis\u00e9 \u00ab\u00a0Sunburst\u00a0\u00bb pour l\u2019occasion, et du vol de plusieurs outils de Red Team. Dans ce communiqu\u00e9, l\u2019entreprise de cybers\u00e9curit\u00e9 \u00e9voque la cyberattaque avanc\u00e9e d\u2019un acteur \u00ab\u00a0dont la discipline, la s\u00e9curit\u00e9 op\u00e9rationnelle et les techniques portent \u00e0 croire qu\u2019il s\u2019agirait d\u2019une attaque parrain\u00e9e par un \u00c9tat\u00a0\u00bb. D\u00e9j\u00e0 un \u00e9v\u00e8nement en soi \u2013 qui nous rappelle encore une fois qu\u2019en cybers\u00e9curit\u00e9 personne n\u2019est infaillible \u2013, mais surtout, l\u2019arbre qui cache la for\u00eat.<\/strong><\/p>\n<p>&nbsp;<\/p>\n<h2>Les \u00e9l\u00e9ments de contexte de l\u2019attaque Sunburst<\/h2>\n<p>Quelques jours plus tard, le 13\u00a0d\u00e9cembre, nous apprenions l\u2019\u00e9tendue des d\u00e9g\u00e2ts\u00a0: avec FireEye, plus de 18\u00a0000 entreprises et institutions dans le monde seraient concern\u00e9es. Et en premier lieu une quarantaine d\u2019administrations du gouvernement am\u00e9ricain, dont le d\u00e9partement de la s\u00e9curit\u00e9 int\u00e9rieure et le <em>National Nuclear Security Administration<\/em> (NNSA). Leur point commun\u00a0? La pr\u00e9sence dans leur syst\u00e8me d\u2019information du logiciel <em>Orion<\/em> de l\u2019entreprise SolarWinds, qui d\u00e9veloppe des logiciels professionnels pour la gestion centralis\u00e9e des r\u00e9seaux, des syst\u00e8mes et de toute l\u2019infrastructure informatique. D\u2019apr\u00e8s les premiers \u00e9l\u00e9ments de l\u2019investigation, le groupe APT29 (Cozy Bear) semble \u00eatre \u00e0 l\u2019origine de cette attaque.<\/p>\n<p>&nbsp;<\/p>\n<h2>Le vecteur initial de l\u2019attaque Sunburst<\/h2>\n<p>Le vecteur initial de l\u2019attaque serait une compromission en profondeur de ce logiciel de supervision des syst\u00e8mes d\u2019information. Il semble que les versions d\u2019Orion concern\u00e9es remontent jusqu\u2019\u00e0 octobre 2019.<\/p>\n<p>Question technique, le malware aurait \u00e9t\u00e9 introduit dans la cha\u00eene de d\u00e9veloppement du logiciel, et plus pr\u00e9cis\u00e9ment dans celle de la dll <em>solarwinds.orion.core.businesslayer.dll<\/em>. Une dll qui a ensuite \u00e9t\u00e9 sign\u00e9e par le certificat officiel SolarWinds, garantissant sa confiance. Une fois install\u00e9 dans le SI cible, le binaire s\u2019inscrit sur le site de \u00ab\u00a0<em>Beacon<\/em>\u00a0\u00bb du malware en appelant le domaine avsvmcloud.com et en imitant un protocole l\u00e9gitime de SolarWinds. Les cyber-criminels initient ensuite une communication \u00ab\u00a0<em>command and control<\/em>\u00a0\u00bb sur d\u2019autres domaines\/IP qui auront \u00e9t\u00e9 \u00e9chang\u00e9s via la connexion initiale.<\/p>\n<p>\u00c0 noter qu\u2019une simple connexion \u00e0 l\u2019URL avsvmcloud.com n\u2019indique donc pas forc\u00e9ment une compromission active du SI. Il convient de v\u00e9rifier qu\u2019elle est suivie par des communications vers d\u2019autres domaines\/IP.<\/p>\n<p>&nbsp;<\/p>\n<h2>Les d\u00e9tails techniques de l\u2019attaque Sunburst<\/h2>\n<h3>Obfuscation<\/h3>\n<p>Ce malware est technologiquement tr\u00e8s avanc\u00e9 et utilise diff\u00e9rentes techniques de dissimulation telles que\u00a0:<\/p>\n<ul>\n<li>Utilisation de Virtual Private Server pour la communication C&amp;C, avec des IP g\u00e9ographiquement similaires au pays de la victime\u00a0;<\/li>\n<li>Rotation de l\u2019IP \u00ab\u00a0dernier kilom\u00e8tre\u00a0\u00bb sur diff\u00e9rents points g\u00e9ographiques pour limiter la d\u00e9tection\u00a0;<\/li>\n<li>St\u00e9ganographie pour dissimuler les communications de C&amp;C, en utilisant le protocole officiel \u00ab\u00a0<em>Orion Improvment Program<\/em>\u00a0\u00bb comme support\u00a0;<\/li>\n<li>D\u00e9tection (et arr\u00eat) d\u2019ex\u00e9cution en environnement de type sandbox\u00a0;<\/li>\n<li>Utilisation de comptes et de token d\u2019authentification usurp\u00e9s pour les mouvements lat\u00e9raux, les alertes g\u00e9n\u00e9r\u00e9es par ces usurpations n\u2019\u00e9tant g\u00e9n\u00e9ralement pas suffisamment critiques pour \u00eatre vues.<\/li>\n<\/ul>\n<h3>Persistance<\/h3>\n<p>Comme dans la plupart des attaques cibl\u00e9es, l\u2019un des objectifs principaux des cyber-criminels est d\u2019obtenir une certaine persistance de l\u2019acc\u00e8s au SI de la victime. C\u2019est bien \u00e9videment le cas ici \u00e9galement. Plusieurs m\u00e9canismes ont \u00e9t\u00e9 observ\u00e9s\u00a0:<\/p>\n<ul>\n<li>Cr\u00e9ation de comptes \u00e0 privil\u00e8ges et de tokens d\u2019authentification dans l\u2019Active Directory Azure par exemple (acc\u00e8s au \u00ab\u00a0<em>Key Vault<\/em>\u00a0\u00bb)\u00a0;<\/li>\n<li>Ajout d\u2019un nouveau \u00ab\u00a0<em>federation trust<\/em>\u00a0\u00bb sur le domaine de la victime, plus pr\u00e9cis\u00e9ment d\u2019un objet \u00ab\u00a0new Active Directory Federated Service (ADFS) TrustedRealm object\u00a0\u00bb comme un nouveau certificat racine\u00a0;<\/li>\n<li>Installation d\u2019autres Trojans...<\/li>\n<\/ul>\n<h3>IoC<\/h3>\n<p>Les diff\u00e9rents IoC (<em>Indicator of Compromise<\/em>) de l\u2019attaque ont \u00e9t\u00e9 publi\u00e9s par FireEye et sont disponibles ici\u00a0:<\/p>\n<ul>\n<li>Contre-mesures applicables pour d\u00e9tecter le malware SunBurst\u00a0: <a href=\"https:\/\/github.com\/fireeye\/sunburst_countermeasures\" target=\"_blank\" rel=\"noopener\">github.com\/fireeye\/sunburst_countermeasures<\/a><\/li>\n<li>Contre-mesures applicables pour d\u00e9tecter l\u2019utilisation des outils de Red Team vol\u00e9s \u00e0 FireEye\u00a0: <a href=\"https:\/\/github.com\/fireeye\/red_team_tool_countermeasures\" target=\"_blank\" rel=\"noopener\">github.com\/fireeye\/red_team_tool_countermeasures<\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2>Les moyens de protection Stormshield face \u00e0 l\u2019attaque Sunburst<\/h2>\n<p>\u00c0 partir de ces IoC, nous avons d\u00e9velopp\u00e9 des signatures de d\u00e9tection pour nos solutions de protection r\u00e9seau Stormshield Network Security (SNS) et de protection des postes Stormshield Endpoint Security (SES). Ces protections, ainsi que des recommandations g\u00e9n\u00e9riques, sont d\u00e9taill\u00e9es ci-dessous.<\/p>\n<h3>Protection avec SNS<\/h3>\n<p>Plusieurs axes de protection sont activables sur SNS\u00a0:<\/p>\n<ul>\n<li>La base antivirus int\u00e9gr\u00e9e \u00e0 SNS, de base ou en option, doit \u00eatre mise \u00e0 jour afin d\u2019embarquer les nouvelles signatures li\u00e9es \u00e0 Sunburst (fichiers Red Team FireEye, fichiers SolarWinds corrompus). Il s\u2019agit de la version de base ClamAV 26018 et sup\u00e9rieur, et de la version de signature Kaspersky du 13 d\u00e9cembre.<\/li>\n<li>Notre option Extended Web Control int\u00e8gre dans la cat\u00e9gorie \u00ab\u00a0<em>Malware<\/em>\u00a0\u00bb les URL malicieuses utilis\u00e9es par Sunburst pour les communications de \u00ab\u00a0<em>command and control<\/em>\u00a0\u00bb et de \u00ab\u00a0<em>Beacon<\/em>\u00a0\u00bb. Si vous n\u2019avez pas souscrit \u00e0 cette option, vous pouvez bloquer les URL suivantes via une cat\u00e9gorie personnalis\u00e9e\u00a0:\n<ul>\n<li>avsvmcloud[.]com<\/li>\n<li>freescanonline[.]com<\/li>\n<li>deftsecurity[.]com<\/li>\n<li>thedoccloud[.]com<\/li>\n<li>websitetheme[.]com<\/li>\n<li>highdatabase[.]com<\/li>\n<li>incomeupdate[.]com<\/li>\n<li>databasegalore[.]com<\/li>\n<li>panhardware[.]com<\/li>\n<li>zupertech[.]com<\/li>\n<li>virtualdataserver[.]com<\/li>\n<li>digitalcollege[.]org<\/li>\n<\/ul>\n<\/li>\n<li>Enfin, nous avons d\u00e9velopp\u00e9 nos propres signatures IPS list\u00e9es ci-dessous. Ces signatures permettent de d\u00e9tecter l\u2019utilisation d\u2019outils de la RedTeam FireEye ainsi que diff\u00e9rentes phases de l\u2019exploitation de la vuln\u00e9rabilit\u00e9 du logiciel Orion\u00a0:\n<ul>\n<li>http:client.69<\/li>\n<li>http:client:data.153<\/li>\n<li>ssl:server:certificate.105<\/li>\n<li>tcpudp:hostname.156<\/li>\n<li>http:mix.334<\/li>\n<li>http:mix.335<\/li>\n<li>ssl:client:certificate.3<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Protection avec SES<\/h3>\n<p>Nos solutions SES en version 7.2 ou SES Evolution en version 2.0 prot\u00e8gent d\u00e9j\u00e0 de l\u2019utilisation des outils de RedTeam FireEye et des autres logiciels malveillants que les versions corrompues d\u2019Orion auraient pu cr\u00e9er et ex\u00e9cuter, gr\u00e2ce aux fonctions de contr\u00f4le des processus et des ressources syst\u00e8me.<\/p>\n<p>Cependant, afin d\u2019am\u00e9liorer la d\u00e9tection et le traitement des incidents, nous avons int\u00e9gr\u00e9 une base de hash correspondant \u00e0 l\u2019ensemble des fichiers actuellement connus des outils de RedTeam FireEye. Ce sont au total 103 hash qui sont int\u00e9gr\u00e9s dans ce package\u00a0:<\/p>\n<div id=\"attachment_208393\" style=\"width: 610px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-208393\" class=\"wp-image-208393\" src=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-1.png\" alt=\"\" width=\"600\" height=\"240\" srcset=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-1.png 539w, https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-1-300x120.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><p id=\"caption-attachment-208393\" class=\"wp-caption-text\"><em>Fig. 1 : illustration des hash int\u00e9gr\u00e9s \u00e0 nos solutions SES<\/em><\/p><\/div>\n<p>Par ailleurs, sp\u00e9cifiquement sur SES Evolution, nous avons \u00e9galement int\u00e9gr\u00e9 les r\u00e8gles n\u00e9cessaires permettant de couvrir les premiers comportements suspects issus des versions corrompues du logiciel Orion.<\/p>\n<p>Cela repr\u00e9sente 19 adresses IP qui se retrouvent sous contr\u00f4le et qui correspondent aux serveurs utilis\u00e9s par ces versions corrompues. Pour compl\u00e9ter la protection, le programme h\u00f4te d\u2019Orion potentiellement corrompu est \u00e9troitement surveill\u00e9 et ses op\u00e9rations de cr\u00e9ation de fichiers \u00e0 caract\u00e8res malveillant lui sont refus\u00e9es. De m\u00eame, les processus enfants qu\u2019il est amen\u00e9 \u00e0 cr\u00e9er sont bloqu\u00e9s s\u2019ils ne concernent pas d\u2019autres programmes de la suite Orion.<\/p>\n<div id=\"attachment_208394\" style=\"width: 610px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-2.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-208394\" class=\"wp-image-208394\" src=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-2-1024x292.png\" alt=\"\" width=\"600\" height=\"171\" srcset=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-2-1024x292.png 1024w, https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-2-300x86.png 300w, https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-2-768x219.png 768w, https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-2-700x200.png 700w, https:\/\/www.stormshield.com\/wp-content\/uploads\/capture-ecran-2.png 1371w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/a><p id=\"caption-attachment-208394\" class=\"wp-caption-text\"><em>Fig. 2 : illustration des adresses IP int\u00e9gr\u00e9es \u00e0 notre solution SES Evolution<\/em><\/p><\/div>\n<p>Ce package est configurable pour \u00eatre utilis\u00e9 en mode bloquant ou en alerte. Important\u00a0: sur SES Evolution, ce jeu de r\u00e8gles doit \u00eatre ins\u00e9r\u00e9 avant celui de protection par d\u00e9faut.<\/p>\n<p>&nbsp;<\/p>\n<h2>Recommandations face \u00e0 l\u2019attaque Sunburst<\/h2>\n<p>La premi\u00e8re recommandation est bien \u00e9videment de patcher le logiciel Orion de SolarWinds.<\/p>\n<p>Regardez ensuite si des communications ont eu lieu avec le domaine avsvmcloud.com depuis octobre 2019. Si c\u2019est le cas, v\u00e9rifiez si d\u2019autres domaines inhabituels ont \u00e9t\u00e9 en communication avec les syst\u00e8mes h\u00e9bergeant le logiciel Orion. Dans tous les cas, nous vous conseillons vivement de mener une action en profondeur d\u2019investigation sur votre SI, en suivant les \u00e9tapes ci-dessous\u00a0:<\/p>\n<ul>\n<li>D\u00e9connectez d\u2019Internet les syst\u00e8mes qui auraient pu \u00eatre compromis\u00a0;<\/li>\n<li>Ouvrez un incident aupr\u00e8s des autorit\u00e9s comp\u00e9tentes (CNIL \/ ANSSI)\u00a0;<\/li>\n<li>R\u00e9alisez une revue des comptes \u00e0 privil\u00e8ges et des activit\u00e9s pass\u00e9es de ces comptes\u00a0;<\/li>\n<li>Retracez les faux positifs de s\u00e9curit\u00e9 de l\u2019ann\u00e9e pass\u00e9e afin de r\u00e9\u00e9valuer la situation au regard des nouvelles informations disponibles li\u00e9es \u00e0 l\u2019incident\u00a0;<\/li>\n<li>Tracez et suivez toute activit\u00e9 Internet inhabituelle et si n\u00e9cessaire passez en mode \u00ab\u00a0Whitelist\u00a0\u00bb pour limiter les acc\u00e8s Internet aux domaines consid\u00e9r\u00e9s comme s\u00fbrs\u00a0;<\/li>\n<li>Et surtout, faites-vous accompagner par des professionnels si vos \u00e9quipes ne peuvent traiter l\u2019incident.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<hr \/>\n<p>Pour en savoir plus sur l\u2019attaque Sunburst\u00a0:<\/p>\n<p>- La Security Advisory de Solarwinds\u00a0: <a href=\"https:\/\/www.solarwinds.com\/securityadvisory\" target=\"_blank\" rel=\"noopener\">solarwinds.com\/securityadvisory<\/a><br \/>\n- La directive du gouvernement am\u00e9ricain\u00a0: <a href=\"https:\/\/cyber.dhs.gov\/ed\/21-01\/\" target=\"_blank\" rel=\"noopener\">cyber.dhs.gov\/ed\/21-01\/<\/a><br \/>\n- La CERT du gouvernement am\u00e9ricain\u00a0: <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/aa20-352a\" target=\"_blank\" rel=\"noopener\">us-cert.cisa.gov\/ncas\/alerts\/aa20-352a<\/a><br \/>\n- Le communiqu\u00e9 de presse de FireEye\u00a0: <a href=\"https:\/\/www.fireeye.com\/blog\/products-and-services\/2020\/12\/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html\" target=\"_blank\" rel=\"noopener\">fireeye.com\/blog\/products-and-services\/2020\/12\/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html<\/a><br \/>\n- L\u2019analyse d\u00e9taill\u00e9e de FireEye\u00a0: <a href=\"https:\/\/www.fireeye.com\/blog\/threat-research\/2020\/12\/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\" target=\"_blank\" rel=\"noopener\">fireeye.com\/blog\/threat-research\/2020\/12\/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html<\/a><br \/>\nLes masters de d\u00e9tection sur GitHub\u00a0: <a href=\"https:\/\/github.com\/Azure\/Azure-Sentinel\/blob\/master\/Detections\/SigninLogs\/AzureAADPowerShellAnomaly.yaml\" target=\"_blank\" rel=\"noopener\">github.com\/Azure\/Azure-Sentinel\/blob\/master\/Detections\/SigninLogs\/AzureAADPowerShellAnomaly.yaml<\/a> &amp; <a href=\"https:\/\/github.com\/Azure\/Azure-Sentinel\/blob\/master\/Detections\/AuditLogs\/ADFSDomainTrustMods.yaml\" target=\"_blank\" rel=\"noopener\">github.com\/Azure\/Azure-Sentinel\/blob\/master\/Detections\/AuditLogs\/ADFSDomainTrustMods.yaml<\/a><br \/>\n- La protection d\u00e9taill\u00e9e de l\u2019agent Kaspersky\u00a0: <a href=\"https:\/\/securelist.com\/how-we-protect-against-sunburst-backdoor\/99959\/\" target=\"_blank\" rel=\"noopener\">securelist.com\/how-we-protect-against-sunburst-backdoor\/99959\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Le 8 d\u00e9cembre 2020, la soci\u00e9t\u00e9 am\u00e9ricaine FireEye publiait un communiqu\u00e9 de presse dans lequel elle d\u00e9clarait \u00eatre victime d\u2019un malware, baptis\u00e9 \u00ab\u00a0Sunburst\u00a0\u00bb pour l\u2019occasion, et du vol de plusieurs outils de Red Team. Dans ce communiqu\u00e9, l\u2019entreprise de cybers\u00e9curit\u00e9 \u00e9voque la cyberattaque avanc\u00e9e d\u2019un&#8230;<\/p>\n","protected":false},"author":61,"featured_media":190179,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1503],"tags":[4368],"business_size":[682,683,681],"industry":[],"help_mefind":[],"features":[],"type_security":[],"maintenance":[],"offer":[],"administration_tools":[],"cloud_offers":[],"listing_product":[1565,1530],"class_list":["post-208392","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alertes","tag-la-cybersecurite-par-stormshield","business_size-eti","business_size-grande-entreprise","business_size-pme","listing_product-ses-fr","listing_product-sns-fr"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>FireEye, SolarWinds : point sur le malware Sunburst | Stormshield<\/title>\n<meta name=\"description\" content=\"Malware Sunburst : \u00e9tat des lieux de l\u2019attaque. Et quelle protection avec les solutions de s\u00e9curit\u00e9 Stormshield ?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"FireEye, SolarWinds : point sur le malware Sunburst | Stormshield\" \/>\n<meta property=\"og:description\" content=\"Malware Sunburst : \u00e9tat des lieux de l\u2019attaque. Et quelle protection avec les solutions de s\u00e9curit\u00e9 Stormshield ?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/\" \/>\n<meta property=\"og:site_name\" content=\"Stormshield\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-07T18:44:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-08T13:01:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock_1534485395-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1422\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"S\u00e9bastien Viou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Stormshield\" \/>\n<meta name=\"twitter:site\" content=\"@Stormshield\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"S\u00e9bastien Viou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/\"},\"author\":{\"name\":\"S\u00e9bastien Viou\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#\\\/schema\\\/person\\\/81e60bc72521ea12c4ff6e962522948f\"},\"headline\":\"Malware Sunburst : \u00e9tat des lieux d\u2019une attaque avanc\u00e9e et mesures de protection avec Stormshield\",\"datePublished\":\"2021-01-07T18:44:10+00:00\",\"dateModified\":\"2024-04-08T13:01:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/\"},\"wordCount\":1580,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock_1534485395-scaled.jpg\",\"keywords\":[\"La cybers\u00e9curit\u00e9 - par Stormshield\"],\"articleSection\":[\"Alertes\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/\",\"url\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/\",\"name\":\"FireEye, SolarWinds : point sur le malware Sunburst | Stormshield\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock_1534485395-scaled.jpg\",\"datePublished\":\"2021-01-07T18:44:10+00:00\",\"dateModified\":\"2024-04-08T13:01:09+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#\\\/schema\\\/person\\\/81e60bc72521ea12c4ff6e962522948f\"},\"description\":\"Malware Sunburst : \u00e9tat des lieux de l\u2019attaque. Et quelle protection avec les solutions de s\u00e9curit\u00e9 Stormshield ?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock_1534485395-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock_1534485395-scaled.jpg\",\"width\":2560,\"height\":1422},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware Sunburst : \u00e9tat des lieux d\u2019une attaque avanc\u00e9e et mesures de protection avec Stormshield\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#website\",\"url\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/\",\"name\":\"Stormshield\",\"description\":\"Stormshield\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#\\\/schema\\\/person\\\/81e60bc72521ea12c4ff6e962522948f\",\"name\":\"S\u00e9bastien Viou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1f9e044b43142f55cc1ab23bc035ccfa86ed48571830650f7373238e260b03ee?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1f9e044b43142f55cc1ab23bc035ccfa86ed48571830650f7373238e260b03ee?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1f9e044b43142f55cc1ab23bc035ccfa86ed48571830650f7373238e260b03ee?s=96&d=mm&r=g\",\"caption\":\"S\u00e9bastien Viou\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"FireEye, SolarWinds : point sur le malware Sunburst | Stormshield","description":"Malware Sunburst : \u00e9tat des lieux de l\u2019attaque. Et quelle protection avec les solutions de s\u00e9curit\u00e9 Stormshield ?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/","og_locale":"fr_FR","og_type":"article","og_title":"FireEye, SolarWinds : point sur le malware Sunburst | Stormshield","og_description":"Malware Sunburst : \u00e9tat des lieux de l\u2019attaque. Et quelle protection avec les solutions de s\u00e9curit\u00e9 Stormshield ?","og_url":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/","og_site_name":"Stormshield","article_published_time":"2021-01-07T18:44:10+00:00","article_modified_time":"2024-04-08T13:01:09+00:00","og_image":[{"width":2560,"height":1422,"url":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock_1534485395-scaled.jpg","type":"image\/jpeg"}],"author":"S\u00e9bastien Viou","twitter_card":"summary_large_image","twitter_creator":"@Stormshield","twitter_site":"@Stormshield","twitter_misc":{"\u00c9crit par":"S\u00e9bastien Viou","Dur\u00e9e de lecture estim\u00e9e":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/#article","isPartOf":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/"},"author":{"name":"S\u00e9bastien Viou","@id":"https:\/\/www.stormshield.com\/fr\/#\/schema\/person\/81e60bc72521ea12c4ff6e962522948f"},"headline":"Malware Sunburst : \u00e9tat des lieux d\u2019une attaque avanc\u00e9e et mesures de protection avec Stormshield","datePublished":"2021-01-07T18:44:10+00:00","dateModified":"2024-04-08T13:01:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/"},"wordCount":1580,"commentCount":0,"image":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock_1534485395-scaled.jpg","keywords":["La cybers\u00e9curit\u00e9 - par Stormshield"],"articleSection":["Alertes"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/","url":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/","name":"FireEye, SolarWinds : point sur le malware Sunburst | Stormshield","isPartOf":{"@id":"https:\/\/www.stormshield.com\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/#primaryimage"},"image":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock_1534485395-scaled.jpg","datePublished":"2021-01-07T18:44:10+00:00","dateModified":"2024-04-08T13:01:09+00:00","author":{"@id":"https:\/\/www.stormshield.com\/fr\/#\/schema\/person\/81e60bc72521ea12c4ff6e962522948f"},"description":"Malware Sunburst : \u00e9tat des lieux de l\u2019attaque. Et quelle protection avec les solutions de s\u00e9curit\u00e9 Stormshield ?","breadcrumb":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/#primaryimage","url":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock_1534485395-scaled.jpg","contentUrl":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock_1534485395-scaled.jpg","width":2560,"height":1422},{"@type":"BreadcrumbList","@id":"https:\/\/www.stormshield.com\/fr\/actus\/alerte-securite-sunburst-attaque-avancee-et-mesures-de-protection-stormshield\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.stormshield.com\/fr\/"},{"@type":"ListItem","position":2,"name":"Malware Sunburst : \u00e9tat des lieux d\u2019une attaque avanc\u00e9e et mesures de protection avec Stormshield"}]},{"@type":"WebSite","@id":"https:\/\/www.stormshield.com\/fr\/#website","url":"https:\/\/www.stormshield.com\/fr\/","name":"Stormshield","description":"Stormshield","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.stormshield.com\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/www.stormshield.com\/fr\/#\/schema\/person\/81e60bc72521ea12c4ff6e962522948f","name":"S\u00e9bastien Viou","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/1f9e044b43142f55cc1ab23bc035ccfa86ed48571830650f7373238e260b03ee?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1f9e044b43142f55cc1ab23bc035ccfa86ed48571830650f7373238e260b03ee?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1f9e044b43142f55cc1ab23bc035ccfa86ed48571830650f7373238e260b03ee?s=96&d=mm&r=g","caption":"S\u00e9bastien Viou"}}]}},"_links":{"self":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts\/208392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/comments?post=208392"}],"version-history":[{"count":8,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts\/208392\/revisions"}],"predecessor-version":[{"id":510849,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts\/208392\/revisions\/510849"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/media\/190179"}],"wp:attachment":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/media?parent=208392"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/categories?post=208392"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/tags?post=208392"},{"taxonomy":"business_size","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/business_size?post=208392"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/industry?post=208392"},{"taxonomy":"help_mefind","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/help_mefind?post=208392"},{"taxonomy":"features","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/features?post=208392"},{"taxonomy":"type_security","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/type_security?post=208392"},{"taxonomy":"maintenance","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/maintenance?post=208392"},{"taxonomy":"offer","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/offer?post=208392"},{"taxonomy":"administration_tools","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/administration_tools?post=208392"},{"taxonomy":"cloud_offers","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/cloud_offers?post=208392"},{"taxonomy":"listing_product","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/listing_product?post=208392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}