Gold Open Source

Explore Packages Vulnerabilities CWEs MCP Servers Scan

Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

Explore Everything
Packages
Gold Certified Packages
Container Images
AI Models
MCP Servers
Agent Skills
Chip Manufacturers

Security Data & Tools

Scan Your Dependencies
Trending Threats
Threat RSS Feeds
CVE Database
Actively Exploited (KEV)
SGZ Zero-Days
CWE Index
MITRE ATT&CK
Malicious Packages
Security Glossary
Supply-Chain Report
Developers (API & Badge)
Chrome Extension
Credits & Data Sources

Products

The Platform
ESSCM
Portal
TPRM
OSM
Cowork
Code / Runner
Guard

Use Cases

Know Your Software
Auto-Fix Vulnerabilities
Asset Discovery
AI Governance
MCP Server Security
Supply Chain Compliance
Zero-Day Discovery
All Use Cases

Company

About
Pricing
Blog
Documentation
Safeguard Academy
Contact
Privacy Policy
Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard

Home/ATT&CK/Software/S0559

MITRE ATT&CK Malware

SUNBURST (S0559)

Solorigate

ShareX LinkedIn Reddit HN

[SUNBURST](https://attack.mitre.org/software/S0559) is a trojanized DLL designed to fit within the SolarWinds Orion software update framework. It was used by [APT29](https://attack.mitre.org/groups/G0016) since at least February 2020.(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)

Platforms: Windows

▪Techniques implemented (36)

T1497.003Time Based Checks T1047Windows Management Instrumentation T1082System Information Discovery T1112Modify Registry T1573.001Symmetric Cryptography T1132.001Standard Encoding T1070.009Clear Persistence T1005Data from Local System T1124System Time Discovery T1083File and Directory Discovery T1685Disable or Modify Tools T1016System Network Configuration Discovery T1027Obfuscated Files or Information T1546.012Image File Execution Options Injection T1218.011Rundll32 T1027.015Compression T1007System Service Discovery T1036.005Match Legitimate Resource Name or Location T1553.002Code Signing T1057Process Discovery T1001.003Protocol or Service Impersonation T1001.001Junk Data T1059.005Visual Basic T1071.004DNS T1070.004File Deletion T1070.007Clear Network Connection History and Configurations T1497.001System Checks T1012Query Registry T1518.001Security Software Discovery T1033System Owner/User Discovery T1105Ingress Tool Transfer T1027.005Indicator Removal from Tools T1071.001Web Protocols T1001.002Steganography T1568Dynamic Resolution T1070Indicator Removal

▪Used by groups (1)

S0559on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.