But they had been at it only 24 several hours when they identified the passage they’d been wanting for: a one file that appeared to be responsible for the rogue visitors. Carmakal thinks it was December 11 when they discovered it.
The file was a .dll, or dynamic-hyperlink library—code factors shared by other plans. This .dll was substantial, made up of about 46,000 traces of code that carried out more than 4,000 legitimate actions, and—as they found after examining it for an hour—one illegitimate 1.
The principal position of the .dll was to tell SolarWinds about a customer’s Orion use. But the hackers had embedded malicious code that designed it transmit intelligence about the victim’s community to their command server rather. Ballenthin dubbed the rogue code “Sunburst”—a participate in on SolarWinds. They ended up ecstatic about the discovery. But now they had to figure out how the intruders had snuck
