My understanding was that FireEye noticed because this backdoor was used to attack them. They worked it backwards and found the backdoor. It would be interesti

My understanding was that FireEye noticed because this backdoor was used to attack them. They worked it backwards and found the backdoor. It would be interesting to know how many "softer" targets the attacker went after and were completely undetected. It's worth noting that FireEye didn't find the backdoor until after it had been exploited. Nobody can vet modern software. The complexity is too high, let alone accounting for the ridiculous update "velocity" that's coming out of most commercial software today. Just getting software "manufacturers" to itemize and document the normal communication mechanisms used by their software, so that threat hunters aren't reverse engineering communications protocols, would go a long way. If SolarWinds had provided a list of domains their software needed to communicate with that would have gone a long way to stopping this kind of attack. (I can't be the only person who demands vendors provide this info, and who puts third-party software behind MiTM proxies and hard-assed ACLs.)