The Russian group is best known for using tampered software made by federal contractor SolarWinds to breach at least nine US agencies in activity that came to light in December 2020. The attackers were undetected for months in the unclassified email networks of the departments of Justice, Homeland Security and others, and it was FireEye, Mandiant’s former parent firm, not a government agency, that discovered the hacking campaign.