No anti-virus tooling caught this compromise, nothing in the Microsoft sales-pitch caught it either. In fact, Microsoft itself was compromised. FireEye caught

No anti-virus tooling caught this compromise, nothing in the Microsoft sales-pitch caught it either. In fact, Microsoft itself was compromised. FireEye caught the compromise only because $Attacker went a little too far. So one big lesson for any software shop that claims to be professional is to verify builds. It's clear that SloppyWinds is/was completely incompetent. Whoever executed this compromise left nothing behind to indicate a country or linguistic group of origin. (For example, comments or characters of a certain alphabet or encoding.) The perpetrator built the infrastructure patiently [1] and ran small tests before activating a select few of the implanted systems. Small-time $Attackers don't usually show this much attention to the craft. There is skillful software development at work here. [1] https://www.domaintools.com/resources/blog/unraveling-network-infrastructure-linked-to-the-solarwinds-hack https://www.domaintools.com/resources/blog/unraveling-networ... , https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/ https://unit42.paloaltonetworks.com/solarstorm-supply-chain-...