SolarWinds supply chain compromise
A trojanised SolarWinds Orion update reached about 18,000 customers. The attackers then went deeper into selected US government agencies and companies and stayed unnoticed for months.
Hunts for trusted software behaving unusually: new outbound connections from management servers, unexpected authentication token activity and dormant backdoors.