https://www.theregister.com/2020/12/14/solarwinds_fireeye_cozybear/
This situation is properly scary because a supply chain attack that poisons product updates issued by a major security vendor suggests that Cozy Bear could be deep inside all sorts of systems and vendors. If that doesn't scare you, maybe SolarWinds' customer list will:
More than 425 of the US Fortune 500
All of the top 10 US telecommunications companies
All five branches of the US military
The US Pentagon, State Department, NASA, NSA, Postal Service, NOAA, Department of Justice, and the Office of the President of the United States
All of the top five US accounting firms
Former US Cybersecurity and Infrastructure Security Agency head Chris Krebs suggested the attack has likely been under way for months, but that it should be possible to contain.
"If you're a SolarWinds customer & use the below product, assume compromise and immediately activate your incident response team," he advised. "Odds are you're not affected, as this may be a resource intensive hack. Focus on your Crown Jewels. You can manage this."
FireEye has posted an analysis of the flaw in SolarWinds code that says the problem is present in a file called SolarWinds.Orion.Core.BusinessLayer.dll, which it describes as a "digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers."
FireEye says that once the .dll reaches a machine it remains dormant for up to two weeks, but then comes to life and "retrieves and executes commands, called 'Jobs', that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services."