right, once you are in, then you use that to find ways to make the systems less secure so you can utilize other entry points. what happened was a hacker managed to insert malware into updates that were then signed and automatically deployed to all the installs of the product solarwinds orion. This created a trojan whos method of delivery was signed and trusted code. and it would have been delivered to tens of thousands of networks worldwide.. including some in the government. then once the updates were applied.. a few weeks later shit starts happening.. on your systems and its sneaky and looks like legitimate traffic and usage... but its not. Some of the key features are... (besides the sneaky method of deployment.)  Lateral Movement Using Different Credentials Once the attacker gained access to the network with compromised credentials, they moved laterally using multiple different credentials. The credentials used for lateral movement were always different from those used for remote access. Temporary File Replacement and Temporary Task Modification The attacker used a temporary file replacement technique to remotely execute utilities: they replaced a legitimate utility with theirs, executed their payload, and then restored the legitimate original file. They similarly manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returning the scheduled task to its original configuration. They routinely removed their tools, including removing backdoors once legitimate remote access was achieved.  With those above methods, the hacker can pretty much do whatever they want.  Should be noted that now that this has been found, its going to be rare that any systems are not patched so the main issue is fixed, but WHAT DID THEY CHANGE WHILE THEY HAD THE KEYS TO THE CASTLE??? ALSO WHAT DID THEY STEAL COPY DELETE RENAME OR ENCRYPT ETC?? https://www. fireeye .com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html (Why is fireeye a banned domain lol?)