Both the NotPeya ransomware attacks in 2018 - which cost some firms hundreds of millions of dollars - and the SolarWinds cyber strikes in 2023 were both achieved by installing a simple piece of malicious code to a software update and sending it out to clients.