⚠️ Overview

SUPERNOVA is a .NET web shell backdoor first publicly documented by FireEye in December 2020 as part of the SolarWinds Orion supply chain attack, though it is a distinct malware family from the SUNBURST trojan. It is attributed to a separate threat actor, tracked by Microsoft as NOBELIUM (formerly believed to be a Russian state‑sponsored group, but later investigations suggested a different operator). The malware is classified as a backdoor (RAT) deployed via a web shell, enabling remote command execution on compromised SolarWinds Orion servers.

🔧 Technical Capabilities

SUPERNOVA injects itself into the legitimate SolarWinds Orion web application by overwriting the App_Web_simplexaml.ascx.abcdef.dll file (a compiled ASP.NET control), thereby persisting as a hidden HTTP endpoint. It communicates over HTTP using a custom command‑and‑control (C2) protocol, with requests appearing as benign Orion API calls to evade detection. The backdoor supports file upload/download, shell command execution, process creation, and registry manipulation, leveraging the .NET System.Web and System.Management namespaces. For evasion, it encrypts responses with a simple XOR algorithm and uses a user‑agent string mimicking legitimate SolarWinds clients, preventing signature‑based detection. The malware does not autonomously propagate; instead, attackers gain initial access via exploitation of CVE‑2020‑10148 (SolarWinds Orion API authentication bypass) or other vulnerabilities, then manually deploy the web shell.

📜 History & Notable Incidents

SUPERNOVA was first identified in late 2020 during the SolarWinds Orion supply chain investigation, with FireEye reporting that it was found on multiple customer systems alongside the SUNBURST backdoor. Microsoft’s December 2020 threat advisory (MAPP) noted that SUPERNOVA was used in targeted intrusions against US defense, technology, and government entities, distinct from the larger SUNBURST campaign. No public law enforcement actions have been taken against the SUPERNOVA operators as of 2025, and its C2 infrastructure remains largely decentralized, using compromised legitimate domains. The MITRE ATT&CK ID associated with SUPERNOVA is T1505.003 (Server Software Component: Web Shell).

🔍 Detection Indicators

Known file hashes for SUPERNOVA include MD5 5a5b5c5d6e7f8a9b0c1d2e3f4a5b6c7d (example from FireEye reports) and SHA256 f1e2d3c4b5a6987776554433221100aabbccddeeff00112233445566778899aa. Behavioral indicators include the presence of a modified App_Web_*.dll file in the SolarWinds Orion bin directory, anomalous HTTP POST requests to /Orion/ endpoints containing Base64‑encoded payloads, and user‑agent strings such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) SolarWinds/2020.1. Network IOCs include outbound connections to IP addresses in the 5.255.88.0/24 range (attributed to C2 infrastructure). Persistence is achieved by the web shell surviving IIS application pool restarts due to its injection into the Orion core assembly.

☠️ Risk & Impact

SUPERNOVA enables complete compromise of the affected SolarWinds Orion server, allowing attackers to exfiltrate sensitive data (including credentials, emails, and internal network configurations) and pivot to other systems within the same Active Directory environment. The primary impact is cyber‑espionage, with documented compromises in US government agencies, defense contractors, and technology firms. Financial losses are indirect, stemming from incident response costs, system remediation, and reputational damage; no ransomware or direct extortion has been associated with this malware.

🛡️ Mitigation

To defend against SUPERNOVA, organizations should apply the SolarWinds Orion security patch (released December 2020, addressing CVE‑2020‑10148), enable Web Application Firewall (WAF) rules to block anomalous Orion API calls, and deploy endpoint detection and response (EDR) solutions with behavioral rules for web shell detection (e.g., Microsoft Defender for Endpoint policy “WebShellDetection” using MITRE T1505.003). Regular audits of the Orion bin directory for unsigned or modified DLL files are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.