Volexity researchers say they noticed SolarWinds hackers bypass MFA protections at a think tank previously but were subsequently undetected for several years
Dan Goodin / Ars Technica :
Context & Ripple Effects
Volexity's disclosure predates most of the fallout coverage in this corpus: the researchers had already watched the SolarWinds hackers defeat MFA at a think tank and lurk there for years before the supply-chain compromise became public. That detail reframed the incident from a tainted-update story into an identity-attack story — the same operators were shown capable of getting past a control most enterprises treat as their last line of defense.
The weeks that followed confirmed how far ahead of detection the campaign was: hackers ran a backdoor-free test run of the malware in October 2019 before deploying it, Microsoft later found its own source code had been viewed through a compromised employee account, and investigators began probing whether SolarWinds' engineering offices in Czechia, Poland, and Belarus were an entry vector.
First-order effects
- Organizations relying on standard MFA learned their primary control had already been beaten by this actor — the think tank case showed token theft or session hijacking can neutralize second factors without tripping alerts.
- Incident responders like FireEye and Volexity shifted from advisory work to active hunting, with FireEye shipping a free network-auditing tool so victims could self-check for the hackers' known techniques.
Second-order effects
- Microsoft's admission that attackers read some of its source code via an employee account forced every large vendor to re-examine whether privileged accounts — not just endpoints — had been touched, expanding the blast radius well beyond SolarWinds customers.
- Investigators widening the probe to SolarWinds' Czechia, Poland, and Belarus offices signaled that supply-chain due diligence would now extend to where vendors build software, not just what they ship.
Third-order effects
- If a patient actor can bypass MFA and stay undetected for years, the industry structure shifts toward assuming breach: continuous auditing tools, telemetry-sharing between security firms, and scrutiny of vendor development footprints become baseline rather than optional.
- Identity infrastructure becomes the contested terrain — the pattern points toward hardening authentication itself (phishing-resistant factors, session monitoring) rather than layering more perimeter defenses around it, though how fast enterprises move remains genuinely open.
The trend: Nation-state intrusions are shifting from exploiting software flaws to hijacking legitimate identities, making MFA resilience and assumed-breach auditing the new baseline for enterprise defense.