Many of the organizations breached in this operation knew they were in the sights of adept foreign hackers. To guard against the threat and manage their complex networks, they sought technical solutions, including a piece of software called SolarWinds. This spring, when SolarWinds offered a software update, they installed it — trusting the new code, like so many updates before it, would make them more secure.
These organizations were wrong. Hackers reportedly working for the Russian Foreign Intelligence Service (SVR) appear to have placed a stealthy back door in the updated versions of SolarWinds. When customers applied the update, the hackers gained access to their networks. From there, the hackers could reach many additional machines and user accounts, spying undetected for up to nine months. Even though the campaign has come to light, it is nowhere close to over; the hackers still have illicit access in many organizations that will…