Fact-checked by Grok 2 weeks ago

SolarWinds

SolarWinds Corporation is an American software company specializing in hybrid IT observability, monitoring, and management solutions for networks, servers, applications, and databases. Founded in 1999 by IT professionals in Tulsa, Oklahoma, and now headquartered in Austin, Texas, it develops purpose-built tools to simplify IT administration for enterprises, managed service providers, and government entities.^[1]^[2]^[3] The company's flagship offering, the SolarWinds Platform—evolving from the Orion Platform—enables centralized visibility into IT infrastructure performance, alerting, and automation across on-premises, cloud, and hybrid environments. With a customer base exceeding 300,000 organizations and a community of nearly 200,000 IT professionals, SolarWinds emphasizes scalable, user-friendly software that accelerates digital transformation while prioritizing security post-incidents. In April 2025, the company was acquired by Turn/River Capital, transitioning to private ownership to focus on innovation in AI-driven observability and government IT solutions.^[4]^[5]^[6] SolarWinds achieved prominence in December 2020 amid a supply chain compromise, where nation-state actors inserted the SUNBURST malware into legitimate Orion software updates distributed to approximately 18,000 customers. U.S. government assessments, including from the Cybersecurity and Infrastructure Security Agency (CISA), attributed the intrusion—linked to the APT29 group—to Russia's Foreign Intelligence Service (SVR), enabling espionage against select high-value targets in federal agencies, critical infrastructure, and private firms rather than broad ransomware deployment. This breach exposed systemic risks in third-party software dependencies, catalyzing executive orders on cybersecurity, enhanced supply chain scrutiny, and SolarWinds' subsequent investments in code signing, update integrity, and threat detection, though it drew criticism for delayed disclosure and internal security lapses.^[7]^[8]^[9]

Company Background

Founding and Leadership

SolarWinds was founded in 1999 in Tulsa, Oklahoma, by brothers David Yonce and Donald Yonce to develop and provide IT management software solutions for businesses.^[10] Donald Yonce, a former Walmart executive, served as the company's founder and chief architect from February 1999 until December 2006, during which time he also held a position on the board until 2010.^[11]^[12] Following Yonce's departure from operational roles, Kevin B. Thompson joined SolarWinds in July 2006 as chief financial officer and treasurer before ascending to president and chief executive officer in March 2010, a position he held until his retirement at the end of December 2020.^[13]^[14] Under Thompson's leadership, the company expanded significantly through product development and acquisitions, guiding it toward its initial public offering in 2018.^[10] Sudhakar Ramakrishna succeeded Thompson as president and chief executive officer effective January 4, 2021, bringing over two decades of experience in technology leadership from roles at companies including IBM, Dell, and Pulse Secure.^[15]^[10] Ramakrishna assumed the role amid the company's response to the 2020 supply chain compromise but has since focused on enhancing cybersecurity practices, product innovation, and customer trust.^[5] As of 2025, Ramakrishna continues to lead SolarWinds, overseeing its transition to private ownership following the April 2025 acquisition by Turn/River Capital.^[16]

Core Business and Products

SolarWinds Corporation specializes in developing and marketing software solutions for IT infrastructure management, with a focus on providing visibility, monitoring, and automation capabilities for hybrid environments encompassing on-premises, cloud-native, and multi-cloud infrastructures. The company's offerings target IT professionals seeking to simplify complex IT operations, proactively detect issues, and accelerate business transformation through tools that emphasize ease of deployment and scalability. Established as a provider of powerful yet accessible software, SolarWinds serves organizations across various sectors by addressing challenges in network performance, systems monitoring, service desk operations, and database optimization.^[1] At the core of its product portfolio is the SolarWinds Platform (formerly the Orion Platform), a self-hosted foundation that integrates multiple modules for end-to-end IT observability and management. This platform supports monitoring of networks, servers, applications, virtualization, and IP addresses, incorporating features like machine learning for anomaly detection and customizable dashboards for performance analysis. Complementing this are SaaS-based alternatives, such as SolarWinds Observability, which delivers unified metrics, traces, logs, and user experience insights for dynamic hybrid IT setups, priced starting at $7.42 per node per month.^[17]^[18] Key monitoring products built on or alongside the platform include Network Performance Monitor (NPM), which identifies network faults, latency, and device health using technologies like NetPath for critical path visualization, and Server & Application Monitor (SAM), capable of tracking over 1,200 application types via templates and stack-based correlation for root-cause analysis. In IT service management, Service Desk provides cloud-based incident tracking, asset management, and automation with AI enhancements, starting at $39 per technician per month, while Web Help Desk offers on-premises ticketing with SLA enforcement for smaller teams. Database solutions feature Database Performance Analyzer for agentless, cross-platform SQL query tuning with low overhead under 1%, and SQL Sentry for in-depth Microsoft SQL Server metrics. Additional tools like Dameware Mini Remote Control enable cross-platform remote support, and the Engineer's Toolset bundles over 60 utilities for network diagnostics and discovery.^[17]^[19]

Historical Development

Early Growth and IPO

SolarWinds was founded in 1999 in Tulsa, Oklahoma, by brothers David Y. Yonce and Donald Y. Yonce, with an initial focus on developing straightforward software tools to assist IT administrators in network monitoring and management.^[10] The company's early offerings targeted practical challenges faced by systems engineers, emphasizing simplicity and utility in areas such as basic diagnostics and performance tracking.^[2] In 2006, SolarWinds relocated its headquarters to Austin, Texas, and appointed Mike Bennett as CEO, a move that coincided with intensified operational scaling and market penetration in the IT operations management sector.^[20] This period marked the onset of substantial expansion, driven by demand for affordable, on-premises software solutions amid growing enterprise IT complexity. Revenue grew at a compound annual rate of 45% from 2006 to 2009, reflecting strong adoption among mid-sized businesses and IT teams seeking efficient monitoring capabilities.^[21] By March 2009, the workforce had reached 268 employees, supporting broader product development and sales efforts.^[22] The company's trajectory culminated in its initial public offering on May 20, 2009, when it listed on the NASDAQ exchange under the ticker SWI.^[23] SolarWinds sold more than 12 million shares at $12.50 each, raising approximately $151 million in proceeds, which funded further innovation and geographic outreach.^[24] Shares closed the debut day up 10%, signaling investor confidence in its growth model centered on perpetual licensing and low-cost deployment.^[23] This IPO provided capital for sustained revenue increases, with 2009 sales reaching $116.4 million and climbing 31% to $152.4 million in 2010.^[25]

Expansion Through Acquisitions

SolarWinds expanded its IT management software portfolio primarily through acquisitions, acquiring over 20 companies between 2009 and 2020 to integrate specialized tools for network monitoring, security, and service management.^[26] This strategy accelerated after its 2009 initial public offering and continued following its 2016 privatization by Thoma Bravo and Silver Lake, which provided capital for bolt-on deals enhancing product depth without heavy organic R&D investment.^[27] By targeting niche providers, SolarWinds broadened its addressable market in areas like storage, remote access, and cloud observability, contributing to annual recurring revenue growth from $200 million in 2010 to over $1 billion by 2020.^[25] Early acquisitions focused on core infrastructure management. In January 2010, SolarWinds purchased Tek-Tools' assets for $42 million, incorporating storage resource management software to monitor SAN and NAS environments.^[28] The following year, it acquired DameWare Development for $40 million in December 2011, adding remote support and administration tools that integrated with its existing network management suite.^[29] In March 2013, SolarWinds bought N-able Technologies for $120 million, gaining remote monitoring and management (RMM) capabilities tailored for managed service providers, which later formed the basis of a spun-off entity in 2021.^[30] Subsequent deals emphasized cloud and security extensions. SolarWinds acquired Librato in January 2015 for $40 million, bolstering metrics and analytics for cloud-native applications.^[31] In September 2018, it integrated 8MAN's access rights management technology, rebranded as SolarWinds Access Rights Manager, to address identity governance in hybrid environments.^[32] The 2019 acquisition of Samanage for $350 million introduced AI-driven IT service management (ITSM) workflows, expanding into helpdesk automation and asset tracking.^[33] Later acquisitions targeted observability and specialized services. In October 2020, SolarWinds purchased SentryOne, enhancing database performance monitoring for SQL Server and other platforms.^[34] This was followed by the January 2022 buyout of Monalytic, a federal-focused monitoring firm, to strengthen analytics for government clients.^[35] In March 2025, shortly before its privatization, SolarWinds acquired Squadcast for an undisclosed sum, unifying incident response with its observability tools to reduce alert fatigue in DevOps pipelines.^[36] These moves collectively diversified SolarWinds' offerings amid rising demand for integrated IT operations platforms.

The 2020 Supply Chain Compromise

Attack Mechanics and Variants

The SolarWinds supply chain compromise involved adversaries infiltrating the software build process for Orion Platform updates, inserting malware known as SUNSPOT to modify legitimate DLL files during compilation, resulting in the SUNBURST backdoor being embedded in approximately 18,000 customer instances of Orion versions 2019.4 HF5 through 2020.2.1 HF1, distributed between March and June 2020.^[37]^[7] SUNBURST operated as a stealthy implant that remained dormant for 12 to 14 days post-installation to evade detection, after which it initiated command-and-control (C2) communications via DNS queries to domains masquerading as legitimate traffic, followed by HTTP-based exfiltration to actor-controlled servers.^[9]^[38] Once activated, SUNBURST enabled lateral movement and deployment of second-stage payloads in targeted environments, primarily affecting fewer than 100 high-value victims such as U.S. government agencies and private sector entities, rather than broadly exploiting all infected systems.^[7] Key variants included TEARDROP, a DLL used for DLL side-loading to execute Cobalt Strike beacons, which facilitated privilege escalation and persistence through techniques like reflecting code loaders to avoid disk writes.^[38] RAINDROP functioned similarly to TEARDROP, deploying modified Cobalt Strike variants for remote access and credential harvesting.^[38] Additional post-compromise tools encompassed GoldMax, a Go-language backdoor capable of executing commands, enumerating processes, and blending C2 traffic with benign HTTP requests to evade network monitoring; GoldFinder, a credential-dumping utility targeting LSASS memory and Windows registry hives for authentication material; and Sibot, a C++-based implant akin to GoldMax for command execution and data exfiltration.^[39]^[39] SUNSHUTTLE represented another modular backdoor variant used for similar persistence and C2 operations in select intrusions.^[40] These components emphasized operational security, with modular design allowing attackers to tailor payloads based on victim environment, minimizing forensic footprints through in-memory execution and encrypted communications.^[39]

Attribution and Operational Scope

The 2020 SolarWinds supply chain compromise was attributed by the United States government to Russia's Foreign Intelligence Service (SVR), a determination announced in April 2021 based on technical indicators, tactics, techniques, and procedures (TTPs) consistent with SVR operations.^[7] The SVR, also tracked as APT29 or Cozy Bear by cybersecurity firms, had previously been linked to espionage campaigns targeting Western governments and diplomatic entities since at least 2008.^[41] Attribution relied on forensic analysis of malware samples, such as SUNBURST, released by U.S. Cyber Command and the Cybersecurity and Infrastructure Security Agency (CISA), which matched known SVR tooling and evasion methods.^[42] Mandiant, after merging its tracking of the intrusion actors (UNC2452) with APT29 profiles, cited overlapping infrastructure, custom malware variants like TEARDROP, and operational patterns from prior SVR-linked intrusions as confirmatory evidence.^[43] No alternative attributions have gained traction among intelligence or cybersecurity analysts, though the operation's sophistication—evading detection for months—underscored challenges in definitive cyber attribution without human intelligence corroboration.^[44] International partners, including the UK's National Cyber Security Centre, aligned with the U.S. assessment, attributing the compromise to SVR actors exploiting SolarWinds Orion platform updates for global access.^[45] Operationally, the compromise spanned from at least September 2019, when initial access to SolarWinds' build systems occurred, through December 2020, when public disclosure revealed the insertion of backdoors into software updates for Orion versions 2019.4 to 2020.2.1 HF2.^[46] Attackers tampered with approximately 18,000 instances of the Orion software distributed via legitimate updates, but executed deeper intrusions—installing secondary payloads for persistence and data exfiltration—against fewer than 100 high-value targets.^[9] Affected entities included nine U.S. federal agencies (e.g., Departments of Treasury, Commerce, Energy, Homeland Security, and State), as well as private sector firms like Microsoft and Intel, with espionage focused on intelligence collection rather than disruption or ransomware deployment.^[7] The campaign's scope emphasized stealthy lateral movement within networks, using living-off-the-land techniques to blend with legitimate traffic, enabling sustained access for up to nine months in some environments before mitigation.

Immediate Detection and Disclosure

FireEye detected the supply chain compromise on December 11, 2020, while investigating a nation-state intrusion into its own network that it had publicly disclosed three days earlier on December 8.^[47] The investigation revealed that the attackers had inserted malware, dubbed SUNBURST, into legitimate software updates for SolarWinds' Orion platform, distributed between March and June 2020 to approximately 18,000 customers.^[48] FireEye notified SolarWinds of the findings on December 12, prompting the company to initiate its own review.^[47] SolarWinds publicly acknowledged the potential security issue in Orion software updates via a security advisory on its website on December 13, 2020, confirming that malicious code had been inserted into two versions of its Orion Improvement Program (OIP) 11 software builds, released in March and June 2020.^[49] Concurrently, FireEye published a detailed technical blog post on the same day, describing the attack's mechanics, including the backdoor's evasion techniques and its use in targeting high-value networks.^[48] This dual disclosure highlighted the supply chain nature of the breach, with FireEye estimating fewer than 10 victims had active backdoors deployed post-infection, though the initial update distribution affected thousands.^[50] In immediate response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 21-01 on December 13, 2020, ordering federal civilian executive branch agencies to disconnect or power down any Orion products using versions 2019.4 through 2020.2.1 HF2, due to the risk of compromise.^[8] The directive underscored the urgency, noting indicators of compromise traceable back to at least September 2019, though public detection occurred only after FireEye's forensic work.^[7] Microsoft also confirmed on December 13 that it had analyzed the malware and found no evidence of compromise in its systems despite using Orion, contributing to rapid industry awareness.^[50]

Response and Investigations

Company Mitigation Efforts

Following the detection of the supply chain compromise in its Orion Platform software, SolarWinds promptly removed affected software builds from its download sites to prevent further distribution of tampered updates.^[51] The company also released a mitigation script for the SUPERNOVA variant, available via its support downloads, to assist customers in addressing potential post-exploitation tools deployed by attackers.^[51] SolarWinds issued targeted software updates to remediate the SUNBURST backdoor and related threats, including Orion Platform versions 2019.4.2 and 2020.2.4 on January 25, 2021, which incorporated protections against both SUNBURST and SUPERNOVA and were digitally re-signed with new certificates to restore trust in the update process.^[51] Subsequent releases, such as version 2020.2.5 after April 6, 2021, included additional security fixes.^[51] On March 8, 2021, the company revoked its compromised code-signing certificate to invalidate any remaining malicious artifacts.^[51] These remediations were made available through the customer portal, with recommendations for upgrades within specified timelines.^[51] In parallel, SolarWinds collaborated with external firms including KPMG and CrowdStrike to contain the incident, confirming by May 2021 that the threat actor was no longer active within its environment.^[52] Customer notifications began immediately upon awareness, with detailed disclosures via security advisories, blog posts, and webinars; the company identified and informed affected individuals regarding personal data potentially accessed in exfiltrated emails.^[52] For long-term hardening, SolarWinds implemented enhancements to its build environment, including increased code scanning, third-party code reviews, and penetration testing for release processes, alongside credential refreshes across systems.^[51] Broader measures adopted zero-trust principles, mandatory multi-factor authentication, and segmented secure build pipelines across multiple environments, with ongoing monitoring of SaaS tools and stricter vendor assessments to mitigate supply chain risks.^[52] These steps aimed to prevent recurrence by addressing vulnerabilities exposed in the automated build system exploited since at least October 2019.^[52]

Government and Intelligence Assessments

The Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the Federal Bureau of Investigation (FBI), National Security Agency (NSA), and Office of the Director of National Intelligence (ODNI), issued an emergency directive on December 13, 2020, mandating federal civilian executive branch agencies to disconnect or power down SolarWinds Orion software due to evidence of exploitation posing an unacceptable risk.^[53] This was followed by CISA Alert AA20-352A on December 17, 2020, which detailed the advanced persistent threat (APT) compromise of government agencies, critical infrastructure entities, and private sector organizations via a supply chain attack on SolarWinds Orion updates, noting the actors' use of sophisticated techniques for initial access and persistence.^[7] On January 5, 2021, the FBI, CISA, ODNI, and NSA released a joint statement attributing the intrusion to a foreign adversary, later specified as Russia, and established the Cyber Unified Coordination Group (UCG) to coordinate investigation and response efforts across affected entities.^[54] The UCG assessed that while approximately 18,000 SolarWinds Orion customers received the compromised updates between March and June 2020, only a far smaller number—estimated in the low hundreds—were actively targeted for data exfiltration or further operations, with victims including multiple U.S. federal agencies such as Treasury, Commerce, Energy, and Homeland Security, as well as state governments and private firms.^[54] FBI Director Christopher Wray testified in March 2021 that the attack demonstrated adversaries' willingness to invest significant resources in cyber operations threatening U.S. health, safety, and economic security.^[55] The U.S. Intelligence Community (IC) attributed the operation with high confidence to Russia's Foreign Intelligence Service (SVR), also known as APT29 or Cozy Bear, based on tactics, techniques, and procedures (TTPs) matching prior SVR activity, including custom tooling like the Sunburst backdoor and similarities in code and infrastructure to earlier espionage campaigns. This assessment informed the Biden administration's April 15, 2021, sanctions against Russia, including expulsion of diplomats and restrictions on SVR-linked entities, framing the intrusion as a broad espionage effort rather than destructive in intent. CISA and U.S. Cyber Command subsequently released malware analysis reports on April 15, 2021, detailing samples tied to the compromise, such as variants of the Sunburst implant, to aid remediation across sectors.^[42] International assessments aligned with the U.S. IC's findings; for instance, the UK's National Cyber Security Centre (NCSC) in April 2021 corroborated the SVR attribution and urged similar mitigations, while allies including Australia, Canada, and NATO members issued joint statements condemning the operation as state-sponsored Russian activity aimed at intelligence gathering. Government Accountability Office (GAO) reviews in 2022 highlighted coordination gaps in the federal response but affirmed the intrusion's scale, affecting nine federal agencies and prompting enhanced supply chain security directives.^[56] These evaluations emphasized the attack's reliance on living-off-the-land techniques to evade detection, underscoring systemic vulnerabilities in trusted software updates rather than isolated flaws.^[7]

Industry-Wide Implications

The SolarWinds supply chain compromise of 2020 underscored the fragility of third-party software dependencies across industries, as malicious code inserted into Orion software updates between March and June 2020 potentially affected up to 18,000 customers, including critical infrastructure sectors like energy, finance, and healthcare.^[7] This incident demonstrated how attackers could exploit trusted update mechanisms to achieve broad lateral movement, prompting organizations to reevaluate assumptions of vendor trustworthiness and implement stricter controls on software provenance.^[57] In response, the event catalyzed a surge in vendor risk management practices, with surveys indicating that 5% of third-party assessments post-breach revealed direct impacts, leading firms to integrate cybersecurity due diligence into procurement processes, such as continuous monitoring of supplier networks and contractual mandates for incident reporting.^[58] Industry reports highlighted a shift toward runtime verification of software integrity, reducing reliance on static signatures alone, as traditional endpoint detection proved insufficient against stealthy persistence.^[59] The breach directly influenced U.S. policy, culminating in Executive Order 14028 on May 12, 2021, which mandated federal agencies to adopt secure-by-design principles, including software bills of materials (SBOMs) for transparency in component tracking and vulnerability disclosure from critical vendors.^[60] This framework extended implications to private sectors through NIST guidelines, fostering adoption of verifiable builds and attestation models to mitigate similar insertion attacks, though implementation challenges persist due to varying maturity in supply chain tooling.^[8] Broader economic ripple effects included heightened cybersecurity investments, with global spending on supply chain defenses projected to rise as firms grappled with remediation costs estimated in billions, alongside a reevaluation of cyber insurance exclusions for unpatched vendor flaws.^[61] The incident also exposed systemic gaps in cross-sector information sharing, spurring initiatives like enhanced CISA alerts to promote collective defense without compromising competitive edges.

Legal and Regulatory Aftermath

SEC Enforcement Actions

On October 30, 2023, the U.S. Securities and Exchange Commission (SEC) filed a civil complaint in the U.S. District Court for the Southern District of New York against SolarWinds Corporation and its Chief Information Security Officer, Timothy G. Brown, alleging violations of the antifraud provisions under Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5, as well as failures in reporting under Sections 13(a), 13(b)(2)(A), and 13(b)(2)(B).^[62] ^[63] The SEC contended that SolarWinds and Brown defrauded investors by overstating the company's cybersecurity measures in public statements, including a "Security Statement" on its website that rated practices as "Excellent" or "Good" despite known vulnerabilities such as weak password policies, unpatched systems, and the "golden SAML" exploit pathway later abused in the SUNBURST attack.^[62] Post-breach disclosures in December 2020 and Form 8-K filings were also alleged to have understated risks and omitted material details about the intrusion's scope.^[63] The complaint highlighted specific pre-attack lapses, including SolarWinds' failure to disclose cybersecurity risks in its 2018-2019 Form 10-K filings despite internal awareness of issues like remote access without multi-factor authentication and a 2018 penetration test revealing exploitable flaws.^[63] Brown was accused of aiding and abetting these failures, having approved the Security Statement while knowing of contrary evidence from internal audits and third-party assessments.^[62] The SEC sought permanent injunctions, civil penalties, and disgorgement against both defendants.^[63] On July 18, 2024, the court partially dismissed the SEC's claims, ruling that many alleged misstatements constituted non-actionable corporate puffery or were protected under the PSLRA safe harbor for forward-looking statements, but permitted certain fraud claims to proceed, including those tied to the website Security Statement and specific post-breach omissions.^[64] The court rejected SEC arguments on internal accounting controls, finding insufficient allegations of materiality or scienter for most reporting violations.^[64] On July 2, 2025, the SEC, SolarWinds, and Brown announced a preliminary settlement to resolve the remaining claims, requesting a stay of proceedings pending commission approval and judicial endorsement.^[65] Terms of the agreement, including any penalties or admissions, were not publicly detailed at the time, marking a resolution amid criticisms of the SEC's cybersecurity enforcement approach under prior leadership.^[66]

Shareholder and Class Action Lawsuits

In the wake of the December 13, 2020, disclosure of the supply chain compromise affecting its Orion software platform, SolarWinds Corporation faced shareholder lawsuits alleging violations of federal securities laws. Investors claimed that the company and its executives made materially misleading statements and omissions regarding the adequacy of its cybersecurity measures, thereby artificially inflating the stock price prior to the breach revelation.^[67]^[68] A putative class action securities fraud complaint was filed in the United States District Court for the Southern District of Texas on January 14, 2021, by lead plaintiff Heavy & General Laborers Union Local 61 Pension Fund, represented by Bernstein Litowitz Berger & Grossmann LLP. The suit, captioned In re SolarWinds Corporation Securities Litigation, covered the proposed class period from October 18, 2018, through December 17, 2020, encompassing all persons or entities that purchased or acquired SolarWinds common stock during that time. Allegations centered on SolarWinds' public statements, including SEC filings, earnings calls, and website claims, which purportedly overstated internal controls like multi-factor authentication and penetration testing while understating known vulnerabilities exploited in the attack. Plaintiffs argued these disclosures failed to convey material risks, leading to a sharp stock price decline—from approximately $48 per share pre-disclosure to around $21 by December 17, 2020—causing investor losses estimated in the billions.^[68]^[69] SolarWinds moved to dismiss the consolidated amended complaint in March 2022, contending that its disclosures were sufficiently cautionary under the Private Securities Litigation Reform Act's safe harbor for forward-looking statements and that the breach stemmed from sophisticated nation-state actors beyond ordinary business risks. The court denied the motion in part on September 9, 2022, allowing claims related to specific historical statements about cybersecurity practices to proceed while dismissing others as immaterial or protected puffery. No trial occurred, as the parties reached a preliminary settlement agreement on November 1, 2022, for $26 million in cash, to be distributed pro rata to class members after fees and expenses. The settlement, which included no admission of wrongdoing by SolarWinds, received final court approval on May 26, 2023, resolving all claims.^[67]^[69] Separate derivative suits by shareholders alleging breaches of fiduciary duty against directors and officers for inadequate oversight were consolidated and stayed pending the securities class action resolution, with no independent payouts reported as of 2025. The $26 million settlement amount reflected approximately 4-5% recovery for the class based on alleged damages, consistent with median outcomes in similar cybersecurity-related securities litigation where causation and materiality are contested due to external threat actors.^[68]

Defenses and Outcomes

SolarWinds mounted defenses in the SEC enforcement action by arguing that its pre-attack disclosures, including risk factors in SEC filings and blog posts about prior red-team exercises, constituted non-actionable puffery or forward-looking statements protected under the Private Securities Litigation Reform Act, and that the SEC's allegations improperly applied hindsight to immaterial risks unknown at the time.^[70] The company further contended that the SUNBURST malware's sophistication—evading detection for months via a supply-chain compromise—exceeded reasonable foreseeability for a software firm, rendering claims of inadequate internal controls speculative.^[71] On July 18, 2024, the U.S. District Court for the Southern District of New York granted SolarWinds' and CISO Timothy Brown's motion to dismiss most claims, holding that the SEC failed to plead material misstatements or scienter with particularity, as the alleged omissions did not rise to fraud absent evidence of deliberate concealment.^[72] The court permitted narrow claims to proceed solely on alleged failures in disclosure controls related to the 2019 "Knife and Fork" and 2020 "Hunter" intrusions, but rejected broader cybersecurity adequacy allegations.^[70] In July 2025, the SEC and SolarWinds reached a preliminary settlement resolving all remaining claims, with terms confidential and no public disclosure of penalties or admissions; the case was stayed pending commissioner approval, extended into October 2025 due to procedural delays.^[73]^[74] In the consolidated shareholder class action lawsuits, plaintiffs alleged violations of Sections 10(b) and 20(a) of the Securities Exchange Act, claiming SolarWinds concealed cybersecurity vulnerabilities leading to a 40% stock drop post-disclosure on December 13, 2020.^[75] SolarWinds defended by asserting lack of scienter, immateriality of the intrusions (affecting fewer than 18,000 of 300,000 Orion instances with limited data exfiltration), and that the attack's nation-state origins negated negligence claims.^[69] The parties reached a $26 million cash settlement on November 7, 2022, covering all purchasers of SolarWinds common stock from October 18, 2018, to December 17, 2020, without admission of liability; court approval followed, with initial claimant distributions in July 2024 and a second in July 2025.^[76] No further appeals or related private litigation outcomes have been reported as of October 2025.

Criticisms and Debates

Pre-Attack Security Practices

Prior to the SUNBURST supply chain compromise discovered in December 2020, SolarWinds publicly asserted robust cybersecurity measures in its October 2018 pre-IPO Security Statement, claiming adherence to the NIST Cybersecurity Framework and implementation of a Secure Development Lifecycle (SDL).^[63] Internal evaluations, however, revealed substantial shortcomings; a September 2019 assessment determined that only 6% of NIST SP 800-53 controls were fully satisfied, while 61% lacked any established program, and a FedRAMP review that month found 27% of security controls unmet.^[63] Basic hygiene practices were deficient, including failure to enforce strong password policies—audits in April 2017 and April 2018 identified ongoing use of default credentials such as "password" and storage of passwords in plain text.^[63] Access management remained weak, characterized by widespread administrative privileges and a VPN vulnerability disclosed in June 2018, which was flagged as posing "major reputation and financial loss" risks but not comprehensively addressed until after its exploitation in January 2019.^[63] A security incident in 2018 traced back to the unremediated VPN flaw, uncovered during an August 2018 penetration test, enabled unauthorized system access.^[63] Although a January 2018 internal email acknowledged inaccuracies in prior SDL representations and outlined remediation plans for 2018, persistent gaps in controls—including those governing software development and build environments—undermined defenses, as evidenced by an October 2018 assessment deeming the overall posture "very vulnerable."^[63] SEC filings, such as the October 2018 Form S-1, disclosed cybersecurity risks in generic terms without referencing these specific deficiencies or incidents.^[63] These practices drew criticism for fostering a lax security culture; as early as 2017, internal warnings to executives highlighted that neglect of cybersecurity rendered a breach inevitable, particularly in securing code compilation and update processes against tampering.^[77] The absence of rigorous, mandatory code reviews during builds and inadequate isolation of development infrastructure contributed to undetected persistence by adversaries who gained network foothold in early 2020.^[63]^[77]

Attribution Challenges and Geopolitical Context

The attribution of the SolarWinds supply chain compromise to Russian state actors faced significant technical and evidentiary hurdles inherent to cyber operations, where perpetrators can mask their origins through proxy servers, stolen credentials, and code obfuscation. Cybersecurity firm FireEye first publicly disclosed the breach on December 13, 2020, identifying the intruders as an advanced persistent threat group (APT29 or Cozy Bear) but stopping short of national attribution due to the operation's sophistication. On April 15, 2021, the U.S. National Security Council, in coordination with the FBI, NSA, CISA, and ODNI, formally attributed the campaign to Russia's Foreign Intelligence Service (SVR), citing high-confidence intelligence community assessments based on tactics, techniques, and procedures (TTPs) consistent with prior SVR-linked activities, such as custom malware implants like SUNBURST and behavioral patterns in network persistence.^[78]^[79] Challenges in definitive attribution stemmed from the absence of publicly releasable "smoking gun" evidence, reliance on classified signals intelligence, and the potential for advanced actors to emulate others' TTPs to create plausible deniability—though U.S. officials emphasized that the malware's unique code signing and command-and-control infrastructure aligned exclusively with SVR tooling, corroborated by shared samples released by U.S. Cyber Command. Independent analyses by firms like Microsoft reinforced this, noting "substantial evidence" from forensic artifacts matching Russian operations, yet skeptics highlighted the probabilistic nature of cyber attribution, where false positives or state-sponsored misdirection could not be entirely ruled out without full disclosure of sources. Russia's SVR has a history of espionage-focused intrusions, but the operation's scale—potentially affecting up to 18,000 Orion users before selective targeting of high-value entities like U.S. Treasury and Commerce departments—amplified demands for transparency amid concerns over intelligence community biases toward adversarial framing.^[42]^[80]^[81] Russian officials, including SVR director Sergey Naryshkin, categorically denied involvement, dismissing U.S. claims as unsubstantiated and suggesting without evidence that Western intelligence fabricated the narrative to justify sanctions; state media like RT echoed this, portraying attributions as "evidence-free" propaganda despite forensic IOCs (indicators of compromise) linking backdoors to Russian infrastructure. This denial aligns with Moscow's standard posture in cyber disputes, leveraging the attribution gap to erode credibility of Western assessments, though experts noted inconsistencies, such as the hackers' avoidance of data exfiltration from non-strategic victims, inconsistent with non-state actors.^[82]^[83] Geopolitically, the compromise unfolded against escalating U.S.-Russia frictions, including Moscow's interference in the 2020 U.S. election, annexation of Crimea, and support for separatists in Ukraine, positioning the hack as a classic intelligence-gathering probe rather than destructive cyberwarfare. The SVR's focus on exfiltrating emails and monitoring rather than sabotage underscored Russia's hybrid strategy of persistent access for strategic leverage, prompting Biden administration sanctions on April 15, 2021, targeting six Russian entities and 16 tech officials while expelling diplomats—measures Russia decried as escalatory. This incident exacerbated debates over cyber norms, with U.S. policymakers viewing it as emblematic of supply chain threats from autocratic rivals, yet response constraints highlighted attribution's role in deterrence: without irrefutable proof, retaliation risks miscalculation, as evidenced by public U.S. reticence for kinetic reprisals.^[84]^[44]^[85]

Claims of Regulatory Overreach

In the aftermath of the SolarWinds supply chain compromise disclosed on December 13, 2020, the U.S. Securities and Exchange Commission (SEC) initiated enforcement actions alleging that the company and its Chief Information Security Officer (CISO), Timothy Brown, made misleading disclosures about cybersecurity practices prior to the breach and failed to maintain adequate internal accounting controls under Section 13(b)(2)(B) of the Securities Exchange Act of 1934.^[62] Critics, including SolarWinds executives and legal analysts, contended that these actions represented regulatory overreach by expanding securities laws into realms traditionally governed by cybersecurity expertise rather than financial reporting standards.^[86] SolarWinds argued that the SEC's complaint was "fundamentally flawed—legally and factually," asserting that pre-breach statements about cybersecurity measures, such as risk factor disclosures and a website security statement, were not materially misleading given the sophisticated, state-sponsored nature of the SUNBURST malware attack attributed to Russian intelligence.^[86] The company maintained that no reasonable investor would interpret generic or forward-looking statements as guarantees against undetected intrusions, especially since the breach evaded detection by SolarWinds and multiple U.S. government agencies for months.^[87] Industry observers echoed this, warning that SEC scrutiny of routine cybersecurity disclosures could stifle innovation and impose hindsight bias on incident response, as the attack exploited a zero-day vulnerability unknown at the time.^[88] A pivotal judicial rebuke came on July 18, 2024, when U.S. District Judge Paul Engelmayer dismissed most of the SEC's claims, including the novel application of internal accounting controls to cybersecurity practices, deeming it an "impermissible overreach" that stretched the statute beyond its intent to encompass financial integrity rather than operational security protocols.^[89]^[90] The court ruled that Section 13(b)(2)(B) does not mandate "extensive, expensive, and inevitably imperfect" cyber defenses as accounting controls, noting the SEC's theory would require companies to disclose every vulnerability or risk mitigation gap, potentially rendering all firms non-compliant.^[91] Only claims related to a specific website "Security Statement" survived, highlighting the limits of SEC authority in cybersecurity enforcement.^[71] Trade associations and cybersecurity experts criticized the SEC's approach as chilling transparency, arguing it incentivizes vague disclosures to avoid liability rather than substantive risk management, with lobbying groups labeling the probe an overreach that burdens public companies without enhancing security against nation-state threats.^[88] SolarWinds' defense filings emphasized that the SEC ignored empirical evidence of the attack's stealth—evidenced by its penetration of entities like the U.S. Treasury and Commerce Departments—contending that retroactive standards ignore causal factors like supply chain interdependence and adversary sophistication.^[86] These claims gained traction amid broader debates, as subsequent SEC fines against SolarWinds victims for disclosure lapses drew accusations of punishing breach responders rather than solely perpetrators.^[92] By July 2025, the SEC and SolarWinds reached a preliminary settlement, resolving remaining claims without admitting wrongdoing, which some viewed as a tacit acknowledgment of the overreach critiques, though the agency continued parallel actions against other firms affected by the incident.^[66]^[65] This outcome underscored tensions between regulatory ambitions for cyber accountability and practical constraints, with defenders arguing that true mitigation lies in technical advancements, not expansive legal interpretations prone to hindsight application.^[93]

Post-Compromise Evolution

Financial Recovery and Performance

Following the disclosure of the 2020 supply chain compromise on December 13, 2020, SolarWinds' stock price experienced a sharp decline, dropping approximately 40% in the subsequent week amid investor concerns over potential customer attrition and legal liabilities.^[94] The company incurred direct costs related to the incident, including at least $18 million in expenses for investigation, remediation, and legal fees as of April 2021.^[95] These impacts were compounded by a $26 million settlement in November 2022 to resolve a shareholder class action lawsuit alleging inadequate disclosures about cybersecurity risks.^[69] Despite the breach, SolarWinds maintained revenue growth, with total revenue for fiscal year 2020 (ending December 31, 2020) reaching levels consistent with prior-year increases, including a 7.2% rise in Q4 to $265.3 million.^[96] Preliminary results for Q1 2021 indicated 4% year-over-year growth to $255.8–$256.8 million, though overall expansion slowed in 2021 due to heightened scrutiny and remediation efforts.^[97] Revenue growth stabilized thereafter, reflecting resilience in its core IT management offerings, which comprise the majority of sales. By fiscal year 2023, total revenue reached $758.7 million, a 5% increase from 2022, with recurring revenue accounting for 92% of the total.^[98] This trend continued into fiscal year 2024, with revenue climbing 5% to $796.9 million and recurring revenue rising to 94%.^[99] Quarterly performance in 2024 further demonstrated recovery, including 6% year-over-year growth to $200 million in Q3.^[100] Credit rating agency Fitch noted the return to mid-single-digit growth rates by 2023, attributing stability to the company's subscription-based model despite ongoing regulatory proceedings.^[101] Stock prices, which bottomed near $7.57 in 2022, recovered to approximately $18.49 by mid-2025, though remaining below pre-disclosure peaks around $25.^[102]

Technological Innovations

In response to the 2020 supply chain compromise, SolarWinds implemented security enhancements to its Orion Platform, including digitally re-signed software builds in versions 2019.4.2 and 2020.2.4, which incorporate protections against the SUNBURST backdoor and SUPERNOVA exploit used in the attack.^[51] These updates aimed to mitigate risks from tampered updates by verifying code integrity through enhanced digital signatures and anomaly detection in build processes.^[103] SolarWinds expanded its observability offerings with the launch of SolarWinds Observability on October 19, 2022, a SaaS-based platform providing full-stack visibility across hybrid, multi-cloud, and on-premises environments to detect performance issues and dependencies in real time.^[104] Complementing this, the company introduced SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability), with iterative releases such as version 2025.2.1 incorporating features like API-only monitoring for secure edge device oversight, excluding vulnerable SNMP protocols for devices from vendors including VeloCloud and Palo Alto Networks.^[105]^[106] By 2025, SolarWinds integrated AI-driven capabilities into its platform, including the SolarWinds AI Agent in technical preview for automated data collection and analysis, AI Root Cause Assist for correlating anomalies across infrastructure, and AI Dynamic Threshold Alert Enhancements to adapt alerting based on predictive patterns rather than static rules.^[107] These features leverage machine learning to reduce mean time to resolution in IT operations, as reported by the company in platform updates.^[108] Additionally, SolarWinds adopted third-party tools like ReversingLabs for pre-release binary analysis to bolster supply chain integrity, enabling rapid scanning of complex software artifacts for malware and vulnerabilities before deployment.^[109] The company's software development lifecycle was revised to emphasize secure coding practices, continuous integration with security gates, and reduced reliance on unverified third-party components, as outlined in its Trust Center methodology focused on resiliency.^[110] These innovations reflect a shift toward proactive threat modeling and verifiable build pipelines, though independent verification of their efficacy remains limited to company disclosures and customer adoption metrics.^[103]

Current Market Position and Reputation

As of October 2025, SolarWinds reports trailing twelve-month (TTM) revenue of $0.79 billion USD, reflecting a subscription-heavy model where subscription and maintenance revenues account for approximately 48% of total revenue, with maintenance at 29% and subscriptions at 20%.^[111]^[112] The company's market capitalization stands at $3.23 billion USD in 2025, marking a 58.53% increase from $2.04 billion the prior year, driven by improved financial metrics and stock performance.^[113] SolarWinds holds a 17.21% share in the network management software category, positioning it as a significant player amid competition from tools like those from Cisco and ManageEngine, though its overall IT service management (ITSM) presence is not among the top vendors in the $11.4 billion global market as of 2024.^[114]^[115] The firm's stock (NYSE: SWI) trades with analyst consensus ratings of "Hold" and an average price target of $18.30, implying modest growth expectations, while earnings per share are projected to rise 14.67% to $0.86 in the coming year from $0.75.^[116]^[117] Its price-to-earnings ratio of 81.6 as of mid-October 2025 indicates a premium valuation relative to peers, potentially reflecting recovery optimism but also risks from high leverage and past liabilities.^[118] Reputationally, SolarWinds continues to face lingering scrutiny from the 2020 SUNBURST supply chain compromise, with a July 2025 disclosure revealing a weak default password ("solarwinds123") as a contributing factor to initial access, underscoring pre-incident security lapses despite subsequent remediation efforts.^[119] A July 2025 settlement with the U.S. Securities and Exchange Commission (SEC) resolved allegations of misleading disclosures on cybersecurity risks, without admitting wrongdoing, but highlighted ongoing regulatory pressure on transparency in the sector.^[66] Customer and industry perceptions remain mixed, with the company sustaining operations and issuing reports like the 2024 State of ITSM—indicating persistent adoption in IT operations—but critiques persist regarding product integration issues from acquired modules and elevated breach-related distrust among some enterprises.^[120] Despite these challenges, SolarWinds demonstrates resilience, as evidenced by its active market participation and analyst coverage, though it has not fully dispelled associations with supply chain vulnerabilities in high-security contexts.^[10]

References

[1]
Simple, Powerful, Secure IT - SolarWinds
Solarwinds is a solution provider with a comprehensive observability, IT management, and database management portfolio. Learn more.
[2]
The Best Story in Software: Celebrating 25 Years of SolarWinds
Apr 2, 2024 · SolarWinds was founded by IT professionals solving complex problems in the simplest way, and we have carried that spirit forward since 1999. We ...Missing: Corporation | Show results with:Corporation
[3]
SolarWinds 2025 Company Profile: Valuation, Funding & Investors
SolarWinds was founded in 1999. Where is SolarWinds headquartered? SolarWinds is headquartered in Austin, TX. What is the size of SolarWinds?
[4]
SolarWinds Platform—Scalable IT Monitoring and Observability
Centralized monitoring, management, and observability of your entire IT stack, from infrastructure to application.
[5]
SolarWinds Celebrates Twenty-Five Years of Excellence in IT ...
Apr 1, 2024 · SolarWinds has cultivated a vibrant and engaged user community of nearly 200,000 IT professionals and leaders, fostering collaboration, ...
[6]
Turn/River Completes Acquisition of SolarWinds
Apr 16, 2025 · SolarWinds is a leading provider of simple, powerful, secure observability and IT management software built to enable customers to accelerate ...
[7]
Advanced Persistent Threat Compromise of Government Agencies ...
Apr 15, 2021 · Updated April 15, 2021: The U.S. Government attributes this activity to the Russian Foreign Intelligence Service (SVR).Missing: facts | Show results with:facts
[8]
SolarWinds Cyberattack Demands Significant Federal and Private ...
Apr 22, 2021 · SolarWinds estimates that nearly 18,000 of its customers received a compromised software update. Of those, the threat actor targeted a smaller ...
[9]
SolarWinds Supply Chain Attack Uses SUNBURST Backdoor
Dec 13, 2020 · FireEye discovered a supply chain attack trojanizing SolarWinds Orion business software updates in order to distribute malware we call SUNBURST.Missing: facts | Show results with:facts
[10]
How SolarWinds Makes Money - Investopedia
Jun 19, 2024 · SolarWinds was founded by brothers David and Donald Yonce in 1999 in Tulsa, Okla. to provide businesses with IT management assistance. In 2006, ...
[11]
Who Got Rich This Week: SolarWinds Founder Yonce's Fortune ...
Oct 23, 2015 · It has been a good couple of weeks for Donald Yonce, the founder and largest shareholder of IT software maker SolarWinds.Missing: history | Show results with:history
[12]
Donald Yonce: Profile, Track Record, Trades - Boardroom Alpha
From February 1999 until December 2006, Mr. Yonce held the position of Founder and Chief Architect.
[13]
Solarwinds CEO Kevin Thompson Joins BlackLine Board Of Directors
Thompson has been president and chief executive officer of SolarWinds since 2010, having previously served as chief financial officer and treasurer since 2006, ...
[14]
Kevin B. Thompson, Author at SolarWinds Blog
Kevin Thompson has been our President and Chief Executive Officer since March 2010. He served as our Chief Financial Officer and Treasurer since July 2006.
[15]
Leadership Team | SolarWinds
SolarWinds is a solution provider with a comprehensive observability, IT management, and database management portfolio.
[16]
SolarWinds Appoints Tim Karaca as Chief Financial Officer
Jun 16, 2025 · SolarWinds Appoints Tim Karaca as Chief Financial Officer · Additional Resources Turn/River Completes Acquisition of SolarWinds, April 16, 2025.
[17]
Free Trials of Observability, Network Monitoring, ITSM ... - SolarWinds
Download your free trial of network monitoring, database, and service management tools at SolarWinds to solve your top IT challenges today.
[18]
Orion modules are now self-hosted on the SolarWinds Platform
The SolarWinds Platform is a comprehensive solution for IT monitoring, observability, and service management, with SaaS and self-hosted capabilities.SolarWinds Orion PlatformThe New Orion Platform UIFeaturesOrion MapsOrion Platform now self-hosted ...
[19]
IT Service Desk Software - SolarWinds
An IT service management (ITSM) solution that understands what it takes to successfully manage your employee services. Try SolarWinds Service Desk for free!SolarWinds AI · SolarWinds Orion Platform · Start a free trial · Pricing/FAQsMissing: core | Show results with:core<|separator|>
[20]
SolarWinds keeps on growing - Austin American-Statesman
Nov 20, 2011 · Founded in 1999 in Tulsa, Okla., SolarWinds moved to Austin in 2006, when local high-tech veteran Mike Bennett took over as CEO.
[21]
[PDF] solarwinds 2009 annual report - SEC.gov
... to significant growth in our business we experienced compound annual growth rate in revenue of. 45% from. 2006 to. 2009 Despite the challenges of difficult.
[22]
SolarWinds, Inc. (SWI) IPO - NASDAQ.com
Proposed Symbol, SWI. Company Name, SolarWinds, Inc. Exchange, New York Stock Exchange. Share Price, $12.50. Employees, 268 (as of 03/31/2009). Status ...Missing: early | Show results with:early
[23]
SolarWinds closes up 10 pct, latest to jump in debut | Reuters
May 20, 2009 · SolarWinds was founded in 1999 and filed for its IPO in March 2008, a long waiting period for a software company compared with the late 1990s ...Missing: early details
[24]
SolarWinds Raises $150 Million in IPO - IT Jungle
May 26, 2009 · The company looked to sell more than 12 million shares at a price of $12.50 per share. The IPO raised $151 million, or about $600,000 per ...
[25]
[PDF] solarwinds - SEC.gov
... growth opportunities that lie ahead. Thank you for your investment and continued confidence in SolarWinds. Looking back on. 2010 we are proud of our.
[26]
List of 24 Acquisitions by SolarWinds (Sep 2025) - Tracxn
Sep 6, 2025 · SolarWinds has made a total of 24 acquisitions. The peak acquisition years were 2011 (4), 2018 (3), and 2015 (3). These acquisitions span 13 ...Missing: 2000s | Show results with:2000s
[27]
Thoma Bravo and Silver Lake Complete Acquisition of SolarWinds
Feb 5, 2016 · The acquisition is valued at approximately $4.5 billion, with SolarWinds stockholders receiving $60.10 per share in cash.Missing: 2015 | Show results with:2015
[28]
SolarWinds buys Tek-Tools for storage resource management
Jan 27, 2010 · SolarWinds spends $42 million to acquire assets of Tek-Tools and add storage resource management to its network management product portfolio.Missing: 2000s | Show results with:2000s
[29]
SolarWinds Acquires DameWare Development | Mergr M&A Deal ...
On December 15, 2011, SolarWinds acquired software company DameWare Development for 40M USD. Acquisition Highlights.<|control11|><|separator|>
[30]
SolarWinds Acquires RMM Provider N-able for $120M
SolarWinds (NYSE:SWI) acquired N-able Technologies for $120 million in cash. The deal focuses on cloud-based managed services software for small businesses.Missing: 2010s | Show results with:2010s
[31]
SolarWinds Acquires Cloud Monitoring Company Librato for $40 ...
Jan 30, 2015 · ... company Librato will give them an advantage. On Thursday, SolarWinds acquired San Francisco-based Librato for $40 million. Librato leverages ...
[32]
8MAN is now SolarWinds Access Rights Manager (ARM)
In September 2018, SolarWinds announced a signed agreement to acquire 8MAN with plans to add the 8MAN products to its IT Security Management portfolio in Q4 ...
[33]
SolarWinds Sets Its Sights on the ITSM Market through Acquisition of ...
Apr 11, 2019 · SolarWinds plans to acquire Samanage for a purchase price of $350 million in cash or approximately $329 million net of cash acquired. SolarWinds ...
[34]
SentryOne is now part of SolarWinds
Feb 13, 2024 · SolarWinds acquired SentryOne in October of 2020. Why did ... About SolarWindsCompanyCareersFor GovernmentFor Investors. Resources ...
[35]
SolarWinds Announces Acquisition of Federal Services Provider ...
Jan 18, 2022 · ... acquired Monalytic, a monitoring, analytics, and professional services company, and preferred SolarWinds services provider. This acquisition ...
[36]
SolarWinds Acquires Squadcast, Unifying Observability and Incident ...
Mar 2, 2025 · SolarWinds Acquires Squadcast, Unifying Observability and Incident Response · Isolates the most critical alerts, reducing noise and distractions.Missing: major | Show results with:major
[37]
SUNSPOT Malware: A Technical Analysis | CrowdStrike
Jan 11, 2021 · SUNSPOT is StellarParticle's malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion IT management product.
[38]
Deep dive into the Solorigate second-stage activation - Microsoft
Jan 20, 2021 · Microsoft Threat Intelligence Center (MSTIC) has named the actor behind the attack against SolarWinds, the SUNBURST backdoor, TEARDROP malware, ...Missing: GoldMax | Show results with:GoldMax
[39]
GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM's layered ...
Mar 4, 2021 · Microsoft Threat Intelligence Center (MSTIC) is naming the actor behind the attacks against SolarWinds, the SUNBURST backdoor, TEARDROP malware, ...
[40]
SolarWinds explainer - KPMG International
As reported TEARDROP and RAINDROP were designed to be used by the threat actor(s) to deploy a modified version of Cobalt Strike. Further, SUNSHUTTLE/GoldMax, ...Missing: variants | Show results with:variants
[41]
[PDF] Russian SVR Targets U.S. and Allied Networks
Apr 15, 2021 · Russian Foreign Intelligence Service (SVR) actors (also known as APT29, Cozy Bear, and The Dukes) frequently use publicly known ...
[42]
US Cyber Command, DHS-CISA release Russian malware samples ...
Apr 15, 2021 · US Cyber Command, DHS-CISA release Russian malware samples tied to SolarWinds compromise. By U.S. Cyber Command Public Affairs. FORT GEORGE G.
[43]
UNC2452 Merged into APT29 | Russia-Based Espionage Group
Apr 27, 2022 · Mandiant has gathered sufficient evidence to assess that the activity tracked as UNC2452, the group name used to track the SolarWinds compromise ...
[44]
SolarWinds: Accountability, Attribution, and Advancing the Ball
Apr 16, 2021 · The Biden administration attributed the hacking campaign to Russia's Foreign Intelligence Service (SVR), issued a new Executive Order on Blocking Property.
[45]
Joint advisory: Further TTPs associated with SVR cyber actors
May 7, 2021 · The NCSC, CISA, FBI and NSA publish advice on detection and mitigation of SVR activity following the attribution of the SolarWinds ...
[46]
Autopsy of the SolarWinds Hack - infotex
According to the ongoing investigation by SolarWinds, indicators of compromise go back to September 2019; code modification by the TAs can be seen as early as ...
[47]
A Timeline of the SolarWinds Hack | Kiuwan
Jan 19, 2021 · September 4, 2019: unknown attackers access SolarWinds. · September 12, 2019: the hackers inject the test code and perform a trial run. · February ...Missing: operational scope
[48]
SolarStorm Supply Chain Attack Timeline - Palo Alto Networks Unit 42
Dec 23, 2020 · The SolarStorm timeline summarized here is based on the information available to us and our direct experience defending against this threat.<|separator|>
[49]
The SolarWinds Cyber-Attack: What You Need to Know
Dec 13, 2020 · The advanced persistent threat (APT) actors infiltrated the supply chain of SolarWinds, inserting a backdoor into the product.
[50]
The SolarWinds hack timeline: Who knew what, and when?
Jun 4, 2021 · Details of the 2020 SolarWinds attack continue to unfold, and it may be years before the final damages can be tallied.Missing: scope | Show results with:scope
[51]
FAQ: Security Advisory - SolarWinds
SUNBURST was very sophisticated supply chain attack, which refers to a disruption in a standard process resulting in a compromised result with a goal of being ...
[52]
An Investigative Update of the Cyberattack - SolarWinds Blog
May 7, 2021 · We quickly published information about the attack and notified our customers. We also released remediations to the affected versions of the ...
[53]
ED 21-01: Mitigate SolarWinds Orion Code Compromise - CISA
Dec 13, 2020 · On December 13, 2020, CISA issued ED 21-01 to mitigate the SolarWinds Orion code compromise. As noted in ED 21-01, CISA continues to work with ...
[54]
Joint Statement by the Federal Bureau of Investigation (FBI ... - CISA
Jan 5, 2021 · The UCG believes that, of the approximately 18,000 affected public and private sector customers of Solar Winds' Orion product, a much smaller ...
[55]
Understanding and Responding to the SolarWinds Supply Chain ...
Mar 18, 2021 · The SolarWinds incident shows the investments in time, money, and talent our adversaries are willing to make to conduct malicious cyber activity ...
[56]
[PDF] Federal Response to SolarWinds and Microsoft Exchange Incidents
Jan 13, 2022 · ... attack vectors ... March 9, 2021. CISA released guidance on remediating networks affected by the SolarWinds and Active Directory/M365.<|control11|><|separator|>
[57]
SolarWinds Attack: Play by Play and Lessons Learned - Aqua Security
The SolarWinds attack was discovered in December 2020 ... One of the key lessons from the SolarWinds breach is the need for better supply chain security.Missing: post- | Show results with:post-
[58]
SolarWinds Breach: Top 3 Vendor Risks Identified | Mitratech
Feb 25, 2021 · Impact of the breach: 5% of assessed third parties admitted to being impacted by the SolarWinds breach.
[59]
Bitsight Analysis of SolarWinds Orion Breach — Part 1: Prevalence
Dec 16, 2020 · Even if your organization is not using Orion, business partners, vendors, and suppliers who utilize Orion may pose a risk to your organization.
[60]
FACT SHEET: President Signs Executive Order Charting New ...
May 12, 2021 · This Executive Order makes a significant contribution toward modernizing cybersecurity defenses by protecting federal networks, improving ...
[61]
Two Years Later: An Analysis of SolarWinds and the Impact on the ...
Toward the end of 2020 and through all of 2021, supply chain attacks and ransomware activity led to cyber insurance being one of the most difficult lines of ...
[62]
SEC Charges SolarWinds and Chief Information Security Officer with ...
Oct 30, 2023 · Today's enforcement action not only charges SolarWinds and Brown for misleading the investing public and failing to protect the company's ...
[63]
[PDF] SolarWinds Corporation and Timothy G. Brown - SEC.gov
Oct 30, 2023 · In multiple Company documents, Brown was identified as the “owner” or “approver” of the Security Statement. The “Trust Center” section of ...
[64]
[PDF] Case 1:23-cv-09518-PAE Document 125 Filed 07/18/24 Page 1 of 107
Jul 18, 2024 · ... SEC brings claims against SolarWinds and Brown. Some claims are based on statutory and regulatory grounds familiar to SEC enforcement.
[65]
US SEC, SolarWinds reach preliminary deal to end breach lawsuit
Jul 2, 2025 · US SEC, SolarWinds reach preliminary deal to end breach lawsuit. By Chris Prentice and A.J. Vicens. July 2, 20251:36 PM PDTUpdated July 2, 2025.
[66]
SEC and SolarWinds Reach Settlement in Cybersecurity Case
Jul 10, 2025 · The SEC's lawsuit against SolarWinds claimed that the software company misled investors by downplaying known vulnerabilities in its information ...
[67]
SolarWinds Agrees to $26 Million Payout Over Massive Data Breach
Nov 16, 2022 · SolarWinds Corporation was subject to a massive data breach by suspected Russian-backed hackers who injected malicious code into the company's “Orion” software ...
[68]
SolarWinds Corporation | Bernstein Litowitz Berger & Grossmann LLP
... acquired the common stock of SolarWinds Corporation (“SolarWinds” or the “Company) from October 18, 2018 through December 17, 2020, inclusive (the “Class ...
[69]
SolarWinds agrees to pay $26M to settle shareholder lawsuit over ...
Nov 7, 2022 · IT software giant SolarWinds has agreed to pay $26 million to settle a securities class action lawsuit filed by shareholders over the cyberattack.
[70]
Takeaways From the Dismissal of SEC Claims Against SolarWinds ...
Aug 7, 2024 · The SEC had alleged SolarWinds and its CISO made materially misleading statements and omissions about the company's cybersecurity practices and ...Missing: involvement | Show results with:involvement
[71]
Court in SolarWinds Case Blows Down SEC's Cyber Enforcement ...
Jul 24, 2024 · The SEC charged that SolarWinds allegedly maintained deficient disclosure controls because it misclassified the USTP and Palo Alto events as a ...
[72]
Statement Regarding Administrative Proceedings Against ... - SEC.gov
Oct 23, 2024 · [15] See U.S. Feds Say Russians Likely Behind SolarWinds Hack that Breached Government Networks, Todd Haselton (Jan. 5, 2021), available at ...
[73]
Settlement Alert: The Dust Settles in SEC's Cybersecurity Lawsuit ...
Jul 18, 2025 · The SEC and SolarWinds announced a settlement to end the case against the company related to the 2020 cyberattack on SolarWinds' Orion ...Missing: outcome | Show results with:outcome
[74]
Shutdown delays SEC settlement in SolarWinds case - Westlaw
Oct 9, 2025 · (October 09, 2025) - (Checkpoint News) A federal judge has agreed to delay settlement deadlines in the Securities and Exchange Commission's ...
[75]
https://www.blbglaw.com/cases-investigations/solarwinds
[76]
SolarWinds Securities Litigation - Home
Jul 1, 2025 · The initial distribution of settlement funds to eligible claimants occurred in July 2024. The second distribution occurred in July 2025.
[77]
The Untold Story of the Boldest Supply-Chain Hack Ever - WIRED
May 2, 2023 · The untold story of the boldest supply-chain hack ever. The attackers were in thousands of corporate and government networks. They might still be there now.Missing: attributed | Show results with:attributed
[78]
Russian Foreign Intelligence Service (SVR) Cyber Operations - CISA
Apr 26, 2021 · On April 15, 2021, the White House released a statement on the recent SolarWinds compromise, attributing the activity to the SVR. For ...
[79]
Russian Foreign Intelligence Service Exploiting Five Publicly Known ...
Apr 15, 2021 · This advisory is being released alongside the U.S. government's formal attribution of the SolarWinds supply chain compromise and related cyber
[80]
SolarWinds hack: Russian denial 'unconvincing' - BBC
May 18, 2021 · And Prof Ciaran Martin said there was evidence the tactics, techniques and tools used by the hackers matched "many years of SVR activity". “ ...
[81]
The SolarWinds Hack and the Perils of Attribution
Jan 5, 2021 · On Tuesday, the Cyber Unified Coordination Group issued a statement alleging that hackers “likely Russian in origin” were behind the ...Missing: challenges | Show results with:challenges
[82]
RT Falsely Claims No Proof Kremlin is Behind SolarWinds Hack - VOA
Feb 25, 2021 · Although the SolarWinds hack remains under investigation, Western media have reported evidence implicating Russia.Missing: challenges | Show results with:challenges<|separator|>
[83]
Russia Intel Chief Suggests US, UK Behind SolarWinds Hack
May 18, 2021 · Russia's intelligence chief suggested without evidence that the US and UK orchestrated the SolarWinds hack that breached US government agencies.
[84]
Why the SolarWinds Hack Is a Wake-Up Call
Mar 9, 2021 · The Joe Biden administration has stood by the attribution to Russia and is planning responses, including sanctions, as punishment for the hack.
[85]
American Public Reticent to Retaliate Against SolarWinds Hack
Jan 16, 2021 · Despite bipartisan calls for retaliation to the SolarWinds hack, our new survey evidence suggests that the U.S. public remains highly skeptical.<|separator|>
[86]
Setting the Record Straight on the SEC and SUNBURST - SolarWinds
Nov 8, 2023 · The SEC's lawsuit is fundamentally flawed—legally and factually—and we plan to defend vigorously against the charges. While our full responses ...
[87]
Fatal Flaws in SEC's Amended Complaint Against SolarWinds
Apr 19, 2024 · The SEC charged SolarWinds and its CISO with alleged securities violations based on the company's public statements and SEC disclosures.Missing: overreach | Show results with:overreach
[88]
Legal and Industry Backlash Against SEC's Cybersecurity ...
Mar 28, 2024 · The investigation has prompted criticism from powerful trade and lobbying groups, labeling the SEC's actions as regulatory overreach.
[89]
Internal Accounting Controls Claim Rejected in SolarWinds Case
Jul 23, 2024 · In SolarWinds, the court found that the SEC's attempt to expand Section 13(b)(2)(B) was an impermissible overreach. The court held that the ...
[90]
SEC v. SolarWinds: Court Rejects SEC Authority Over Cybersecurity ...
Jul 18, 2024 · The SEC alleged that defendants grossly overstated the strength of SolarWinds's cybersecurity defenses before a major breach in 2020 and then ...
[91]
Court Dismisses Most of SEC's Claims Against SolarWinds
Aug 3, 2024 · On October 30, 2023, the SEC filed a complaint against SolarWinds and its CISO alleging that they misled investors and customers about known, ...
[92]
Undeterred by the SolarWinds Storm: SEC Charges Victims of ...
Oct 31, 2024 · & Timothy G. Brown decision. The SEC's latest charges make clear that the agency is undeterred in pushing its cyber enforcement agenda ahead.
[93]
Judge Rejects SEC's Aggressive Approach to Cybersecurity ...
Jul 29, 2024 · The SEC alleged that SolarWinds and Brown defrauded investors by overstating the Company's cybersecurity practices and understating or failing ...
[94]
Cyber Case Study: SolarWinds Supply Chain Cyberattack
Oct 17, 2021 · Amid this scrutiny, SolarWinds' stock price fell by 40% the week following the incident. Legal ramifications. In January of 2021—one month after ...
[95]
SolarWinds says dealing with hack fallout cost at least $18 million
Apr 13, 2021 · SolarWinds Corp (SWI.N) said the sprawling breach stemming from the compromise of its flagship software product has cost the company at least $18 million.<|control11|><|separator|>
[96]
SolarWinds Revenue, Earnings After Security Breach - | MSSP Alert
Feb 25, 2021 · SolarWinds Q4 2020 financial results included: Total revenue of $265.3 million, up 7.2% from Q4 of 2019. Total recurring revenue of $230.8 ...
[97]
SolarWinds Announces First Quarter 2021 Preliminary Financial ...
Total revenue in the range of $255.8 million to $256.8 million, representing approximately 4% year-over-year growth, and consisting of: Core IT Management ...
[98]
SolarWinds Announces Fourth Quarter and Full Year 2023 Results
Feb 8, 2024 · Total revenue for the full year of $758.7 million, representing 5% year-over-year growth, and total recurring revenue representing 92% of total ...
[99]
Solarwinds Corp (SWI) 10K Annual Reports & 10Q SEC Filings
Feb 19, 2025 · Total revenue for the fourth quarter of $210.3 million, representing 6% year-over-year growth, and total recurring revenue representing 94% of ...
[100]
SolarWinds Announces Third Quarter 2024 Results
Total revenue for the third quarter of $200.0 million, representing 6% year-over-year growth, and total recurring revenue representing 94% of total revenue.
[101]
Fitch Assigns SolarWinds First-Time IDR of 'B'; Outlook Stable
Mar 3, 2025 · Although revenue growth slowed in 2021 due to the cybersecurity incident, the growth rate returned to the mid-single digits in 2023. The company ...
[102]
SolarWinds (SWI) - Stock price history - Companies Market Cap
Stock price history for SolarWinds (SWI). Highest end of day price: $25.00 USD on 2020-12-08. Lowest end of day price: $7.57 USD on 2022-09-26 ...
[103]
Building Better Software Supply Chain Security by ... - SolarWinds
Sep 25, 2023 · One way to support a more secure supply chain is by building a robust security strategy for software development when using third-party software ...
[104]
SolarWinds Announces Launch of SolarWinds Observability to ...
Oct 19, 2022 · SolarWinds Announces Launch of SolarWinds Observability to Provide Comprehensive Visibility in Hybrid and Multi-Cloud Environments.
[105]
SolarWinds Observability Self-Hosted release history
The current version is 2025.2.1. Version 2023.2 has an EoL announcement, and 2023.1 also has an EoL announcement.
[106]
Announcing SolarWinds Observability Self-Hosted and Network and ...
Improved security for monitoring VeloCloud® and Palo Alto Networks® Prisma SD-WAN1,2: Use API monitoring exclusively for monitoring these edge devices; no SNMP ...
[107]
Discover What's New: The Future of IT Has Arrived - SolarWinds
Introducing SolarWinds AI Agent (Tech Preview) · SolarWinds AI Root Cause Assist · SolarWinds AI Dynamic Threshold Alert Enhancements.
[108]
SolarWinds Platform 2025.2 release notes
Security enhancements and exceptions for SolarWinds Platform products · Configure the SolarWinds Platform Web Console to use HTTPS · What is the Skip website ...
[109]
SolarWinds: Building a Path to Excellence in Software Supply Chain ...
Improved software supply chain security with rapid analysis of large, complex software before release; Increased security assurance for prospective customers ...
[110]
SolarWinds Trust Center
SolarWinds follows a defined software development methodology designed to increase the resiliency and security of our products.Missing: enhancements | Show results with:enhancements<|control11|><|separator|>
[111]
SolarWinds (SWI) - Revenue - Companies Market Cap
According to SolarWinds 's latest financial reports the company's current revenue (TTM ) is $0.79 Billion USD. an increase over the revenue in the year 2023.Missing: FY2021 FY2022
[112]
SolarWinds (SWI) | Finance information - Stockcircle
Revenue Sources ; Subscription And Maintenance, $745.1M · (48.32%) ; Maintenance, $440.59M · (28.57%) ; Subscription, $304.51M · (19.75%) ; License, $51.79M · (3.36%) ...
[113]
SolarWinds Market capitalization 2025 | US83417Q2049 - Eulerpool
Rating 4.9 (755) The market capitalization of SolarWinds 2025 is 3.23 B USD. In 2025, SolarWinds's market cap stood at 3.23 B USD, a 58.53% increase from the 2.04 B USD ...
[114]
SolarWinds - Market Share, Competitor Insights in Network ... - 6Sense
SolarWinds has market share of 17.21% in network-management market. SolarWinds competes with 95 competitor tools in network-management category. The top ...Missing: 2024 | Show results with:2024
[115]
Top 10 ITSM Software Vendors, Market Size and Forecast 2024-2029
Jul 23, 2025 · In 2024, the global IT Service Management software market grew to $11.4 billion, marking a 14.8% year-over-year increase. The top 10 vendors ...
[116]
SolarWinds (SWI) Statistics & Valuation - Stock Analysis
In the last 12 months, SolarWinds had revenue of $796.90 million and earned $111.90 million in profits. Earnings per share was $0.64. Revenue, 796.90M. Gross ...
[117]
SolarWinds (SWI) Stock Price, News & Analysis - MarketBeat
Rating 1.0 · Review by MarketBeatEarnings for SolarWinds are expected to grow by 14.67% in the coming year, from $0.75 to $0.86 per share. Price to Earnings Ratio vs. the Market. The P/E ratio ...
[118]
SolarWinds (SWI) - P/E ratio - Companies Market Cap
P/E ratio on October 18, 2025 (TTM): 81.6. According to SolarWinds 's latest financial reports and stock price the company's current price-to-earnings ratio ( ...
[119]
Weak password "solarwinds123" cause of SolarWinds Hack
Jul 24, 2025 · The SolarWinds supply chain attack was carried out by a malicious update from one of SolarWind's own servers.
[120]
SolarWinds Announces Fourth Quarter and Full Year 2024 Results
Total revenue for the fourth quarter of $210.3 million, representing 6% year-over-year growth, and total recurring revenue representing 94% of total revenue.Missing: early | Show results with:early