Thread by @WIRED

By compromising the IT management platform SolarWinds, Russian hackers have hit departments in the United States government and the security firm FireEye.

We’ll be lucky if that's the end of it. The situation could get so much worse 1/ wired.trib.al/QcCaWFV

As far back as March, the hackers compromised a network monitoring tool called Orion, distributing tainted software potentially to thousands of organizations and giving them a backdoor into the victim’s networks 2/

From there, the hackers fanned out within target systems, often by stealing administrative access tokens. Finally, with the keys to the kingdom—or large portions of each kingdom—they were free to conduct reconnaissance and exfiltrate data 3/

So far, the attack appears to have focused on targeted reconnaissance rather than destruction, but the extent of the damage is difficult to assess in part because Orion itself is a monitoring tool. Identifying potential infections and tracing their source is going to take time 4/

Even though the attack has been discovered, it’s still ongoing. Once hackers have embedded themselves in target networks, simply updating the compromised software isn't enough to flush them out.

They could be exfiltrating data right now 5/

The scope of the hack could be massive. Solarwinds’ products are used across the US government, by many defense contractors, and by most Fortune 500 companies.

It disclosed on Monday that as many as 18,000 clients were potentially vulnerable to the attack 6/

The extent of the exposure at US government agencies is also unknown. The US Commerce, Treasury, and Homeland Security departments have been identified so far, but that may be just the beginning.

In truth, no one knows where the damage ends 7/ wired.trib.al/QcCaWFV