CISA's advisory on the SolarWinds compromise says the actor did not stop at the backdoor. It added credentials to existing cloud application service principals, created new federation trusts, and forged SAML tokens after taking the signing certificate. Those moves gave durable cloud access that survived removal of the original implant.
Persistence through service principals
The advisory says the actor added tokens and certificates to existing Azure and Microsoft 365 application service principals. That gave programmatic access to cloud resources, often through Microsoft Graph, with little telemetry. A service principal is an application identity. Nobody signs in as it, so nobody notices a new credential unless they look.
What to review: list service principals, their credentials and their permissions on a schedule. Alert when a credential is added to an existing one.
Federation trusts
The actor also added new federation trusts to on-premises infrastructure. A federation trust lets one identity provider vouch for users to another system. A rogue trust lets an attacker authenticate outside an organisation's visibility.
What to review: keep an inventory of federation trusts and treat any change as a high severity event.
SAML token forgery
By compromising the SAML signing certificate using escalated Active Directory privileges, the actor created valid but unauthorised tokens. These gave access to services such as hosted email and file storage. The tokens looked legitimate because they were signed by the real certificate.
What to review: protect token signing keys like crown jewels, restrict who can export them, and monitor for tokens issued without a matching sign-in.
Other access routes CISA saw
The advisory also lists password guessing, password spraying and poorly secured administrative credentials reachable through external remote access. It notes a Volexity report describing reuse of a stolen key to bypass multifactor authentication on Outlook Web App. Email accounts of key staff, including IT and incident response, were targeted.
What CISA recommended for cleanup
- Remove actor-controlled accounts and persistence first, then rebuild affected hosts from trusted sources and reset related credentials.
- Treat the identity trust store as compromised when admin credentials or SAML abuse are found.
- Reset the krbtgt password twice, move service accounts to group managed accounts, and review Kerberoasting exposure.
- Retain host, application and network logs for at least 180 days.
- Use out-of-band channels for sensitive response discussions, since the actor read email.
The general lesson
The backdoor was the entry. The lasting damage came from identity. Teams that watched only for malware missed credentials that no scanner would flag. The same logic applies to non-human identities today, including automation and agents: inventory them, scope them, and watch for changes. Safeguard's agent identity capability is built around that idea. See also why signed updates still carried the backdoor.
Quick check
Why are service principals a good persistence target?
They are non-interactive identities, so a newly added credential rarely draws attention.
Does removing the implant end the incident?
No. CISA says to remove actor-controlled accounts and persistence, then rebuild and reset credentials.
Sources
Last reviewed: 19 October 2026.
