There was an org that didn’t see The data exfil hacking spree. A patch went up, our guard was down, Oh blow, SolarWinds, blow.
Soon may the Vendorman come, And bring us Yara rules to run. One day when their huntin' is done, They'll take their scripts and go.
There was no implant here before, But after was a sly backdoor. The C2 signals they did soar And labored low and slow.
As the attack did laterally move Our foe did get into their groove; Stealing certs; installing ‘sploits Wher’er they did go.
Then one day in the by and by, Some clever folk with a firey-eye, Spotted something amiss in Orion’s belt And a delvin’ they did go.
The sunburst cleared and they did see The origin of their recent misery. A blog went up; they did proclaim Many other orgs were laid low.
As far as I’ve heard, the fight’s still on; The C2s blocked but the attackers aren’t done. The Vendorman makes his regular call To help CISO, crew and all.