According to a Microsoft security research blog , a second hacking group , different from the one now associated with the major data breach at SolarWinds and which is linked to Russia , had also targeted the company's products earlier this year.
"Investigation into the entire SolarWinds breach led to the discovery of additional malware that also affects the SolarWinds Orion, but has been shown to be likely unrelated to this breach and is being used by a different threat actor," Microsoft said in its blog post.
According to security experts who told Reuters, this second attempted breach became known as “SUPERNOVA.”
It's a piece of malware that mimics SolarWinds' Orion product, but it's not "digitally signed" like the other attack, suggesting that this second hacking group did not share access to the company's internal network management systems.
It is unclear whether SUPERNOVA has been used against targets such as SolarWinds customers.
The malware appears to have been created in late March, based on a review of the file collection times.
The new finding shows how more than one sophisticated malicious group saw SolarWinds, which is based in Austin, Texas and had not been in the spotlight until this month, as an important gateway to infiltrate other targets.
In a statement, a SolarWinds spokesperson did not address SUPERNOVA, but said the company “remains focused on working with customers and experts to share information and work to better understand this issue.”
"It is still too early to draw a definitive conclusion from the investigation," the spokesman said.
