[richardjennings]

"Finally, the backdoor composes a JSON document into which it adds the unique user ID described earlier, a session ID, and a set of other non-relevant data fields. It then sends this JSON document to the C2 server."

Is there any further explanation of how this was achieved? One might expect as "par for the course" that all external connections be blocked aside from explicitly designated ranges. I would expect that an attempt at external comms would set off alarms.

[nhoughto]

I was wondering the same, if the compromise is of the Orion product which presumably isn't just sitting there with open access to the internet? Like this doesn't seem to be a very broad exploit that could start on a machine with outside world access (like a Windows exploit itself) and then pivot into more sensitive areas.

[Corrado]

It's my understanding that multiple, unexplained NXDOMAIN responses IS what exposed the compromised systems. Why it didn't happen earlier (or immediately) is a good question.