Russian SVR (APT29/Cozy Bear) compromised SolarWinds build environment and injected SUNBURST backdoor into Orion software updates distributed March-June 2020. ~18,000 customers received poisoned update; ~100 organizations actively targeted including US Treasury, State Dept, DHS, FireEye. Initial network compromise began Sept 2019. Discovered Dec 13 2020 when FireEye investigated theft of its own red team tools. MITRE ATT&CK Campaign C0024. US and UK governments attributed to Russian SVR in April 2021.