SolarWinds (2020)

Russian intelligence agency SVR inserted malicious code into SolarWinds' Orion software update, compromising 18,000 organizations including the US Treasury, State Department, and Microsoft. The supply-chain attack — active for nine months before discovery — was described by Microsoft President Brad Smith as "the most sophisticated and large-scale cyberattack" ever conducted.