As a nation-state attack, time and money were no object; the targets were the issue. Consequently, the Russian government strategically chose a critical supply chain partner to thousands of companies. The Russian government, by leveraging its nation-state capabilities, was able to compromise the software update process of SolarWinds, which was previously thought to be very difficult to penetrate. SolarWinds's cyber protections included two-factor authentication, digital key certificates and signed firmware upgrades. The compromise of these "unbreakable" systems enabled this Russian group to have undetected, unfettered access to key IT and OT devices throughout mission-critical networks. By attacking the SolarWinds platform, the Russians were able to get a "two-fer," that is, persistent access and data exfiltration from the IT networks and access to control system devices and control system OT networks.