A website called "SolarLeaks" is publicly selling data about companies that they claim have been compromised in the SolarWinds attack .
It can be seen that the product source codes from companies such as Microsoft, Cisco, SolarWinds, and FireEye are all marked for sale at different prices, ranging from 50,000 US dollars to 600,000 US dollars, all packaged and sold at a price of 1 million US dollars. Bargaining is not supported.
ALL LEAKED DATA FOR 1,000,000 USD (+ bonus)
[Microsoft Windows (partial) source code and various Microsoft repositories] price: 600,000 USD data: msft.tgz.enc (2.6G) link: https://mega.nz/file/1ehgSSpD#nrtzQwh-qyCaUHBXo2qQ1dNbWiyVHCvg8J0As8VjrX0 [Cisco multiple products source code + internal bugtracker dump] price: 500,000 USD data: csco.tgz.enc (1.7G) link: https://mega.nz/file/sSgQmJLT#NqaaYXsFkASwAc51lcjBnWjP4zrbqiN-XQ7GVZGbL_o [SolarWinds products source code (all including Orion) + customer portal dump] price: 250,000 USD data: swi.tgz.enc (612M) link: https://mega.nz/file/xawhBQgJ#f3X6lPORF16wh-O9GiNVMVDZ6rxRKX64_XVR5y9KpFM [FireEye private redteam tools, source code, binaries and documentation] price: 50,000 USD data: feye.tgz.enc (39M) link: https://mega.nz/file/hOBnVYjL#l3qojAvaFWtYtcB3vX4ZABG3tBLGyhJarBBbYaHnM-0
According to previous reports , in the SolarWinds attack, the Microsoft Security Response Center (MSRC) admitted that hackers accessed Microsoft source code, but did not compromise security. Cisco’s latest report claims that they have known the SolarLeaks website and there is no evidence that the attackers stole their source code.
The researchers found that the "SolarLeaks" website has only been registered for one day, and it was registered through the anonymous domain name registration agency NJALLA. When viewing the WHOIS records of the website, the assigned name server will also mock with the phrase "You Can Get No Info".
The website also mentioned that the source code sold now is the first batch of data, and more content will be announced in the coming weeks. This approach is similar to Shadow Brokers in that they sell the stolen data in batches and declare that more content will be released in the future.