In December 2020, one of the most sophisticated cyber espionage operations in history was uncovered. APT29, a cyber threat group linked to Russia's Foreign Intelligence Service, infiltrated the software supply chain of SolarWinds. By injecting a backdoor known as SUNBURST into an Orion software update, they gained access to multiple high-value targets, including government agencies. This training scenario will guide you through the investigation of this complex supply chain attack, exploring the domain generation algorithm used for command and control, and the second-stage payloads deployed to compromise sensitive networks.