VERY IMPORTANT

"The threat actor gained access to the web server and installed a web shell to send commands and orchestrate the rest of the attack. Given the recent supply chain attack on SolarWinds, this attack is certainly of note. However, we could not identify concrete evidence that the two are connected. The C2s, web shell, and DLL used in this attack are not ones we have observed before, outside of this single incident, nor have we observed them used since."