Hackers hid in SolarWinds' update — 18,000 organizations installed the backdoor

In December 2020, cybersecurity firm FireEye discovered that hackers had compromised SolarWinds' Orion network management software by inserting a backdoor into a legitimate software update. The compromised update was distributed to approximately 18,000 organizations, including US government agencies (Treasury, Justice, Commerce, Homeland Security) and Fortune 500 companies.

The attack was a 'supply chain' compromise: rather than hacking individual targets, the attackers infiltrated the software vendor's build process and let the victims install the malware themselves through a routine update. The backdoor, called SUNBURST, was active for approximately nine months before detection.

The US government attributed the attack to Russia's SVR (foreign intelligence service). SolarWinds' stock fell over 40%, and the company faced lawsuits and congressional scrutiny. The case illustrated the vulnerability of software supply chains: when a trusted vendor's update mechanism is compromised, every customer becomes a target, and the attack is invisible because it arrives through the most trusted channel — a signed software update.