SolarWinds produces popular software that helps organizations manage their IT networks and infrastructure. However, it was revealed by FireEye that attacks which compromised the security vendor and US government departments had used the software as a key attack vector.

In a way not dissimilar to the NotPetya attacks of 2017 which began by compromising legitimate Ukrainian accounting software to deliver malware via updates, the attackers appear to have trojanized SolarWinds Orion product.

“FireEye has detected this activity at multiple entities worldwide,” the vendor said on Sunday.

“The victims have included government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East. We anticipate there are additional victims in other countries and verticals.”

Exactly how many organizations had been affected by the attacks was a point of speculation up until now. However, an SEC filing by SolarWinds provided some clarity.

Despite the company boasting 300,000 global customers, it claimed that only 33,000 used the Orion product during and after the period the malicious updates are thought to have been issued: March-June 2020.

“SolarWinds currently believes the actual number of customers that may have had an installation of the Orion products that contained this vulnerability to be fewer than 18,000,” it revealed.

“The communication to these customers contained mitigation steps, including making available a hotfix update to address this vulnerability in part and additional measures that customers could take to help secure their environments. SolarWinds is also preparing a second hotfix update to further address the vulnerability, which SolarWinds currently expects to release on or prior to December 15, 2020.”

Another question mark hanging over the firm is how it was compromised in the first place. Although it didn’t clarify whether the incidents were related, the same SEC filing revealed that SolarWinds had been notified by Microsoft that its Office 365 emails had been compromised by an unnamed “attack vector.”

“[They] may have provided access to other data contained in the company’s office productivity tools,” it noted.