The hack began as early as March when malicious code was snuck into updates to the popular SolarWinds Orion software that monitors computer networks of businesses and governments.
Source: cyware.com