Sector Alert TLP White: Department of Homeland Security releases Cloud/Email compromise detection tool Sparrow, Dec 29, 2020

In mid-December 2020, it was widely reported that a highly sophisticated, large-scale, supply chain cyberattack was conducted against the SolarWinds Orion network management platform which likely impacted almost 18,000 customers. Victim organizations include both government and private sector, across many industry verticals including healthcare. The federal government continues to investigate the full scope of the campaign, as well as develop and highlight actions individual organizations can take to identify associated malicious activity and secure their infrastructure from future compromises. As part of this effort, the Department of Homeland Security (DHS) is releasing a free tool for detecting unusual and potentially malicious activity called Sparrow which can be found here.