Discovered in December 2020, Russian intelligence (SVR/Cozy Bear) had infiltrated SolarWinds since September 2019, injecting trojanized code into the Orion software platform. Approximately 18,000 organizations installed the compromised update, including the US Departments of Homeland Security, Energy, Commerce, Treasury, and State, plus NATO, the European Parliament, and Microsoft. The attackers had undetected access for over nine months. FireEye discovered the breach when they noticed their own red-team tools had been stolen.