The SolarWinds hack was detected when cybersecurity firm FireEye discovered that it had been hacked, and that the attackers had used a malicious update for the SolarWinds Orion network management platform as part of the attack. Upon further investigation, it was discovered that the attackers had compromised the software update process for SolarWinds and had inserted a malicious code into a legitimate update, which was then distributed to SolarWinds customers.
Upon discovering the hack, FireEye immediately took steps to contain the attack and prevent further damage. This included working with SolarWinds to identify and remove the malicious code from the software update, and providing guidance to customers on how to secure their networks and mitigate the impact of the attack.
Other organizations and government agencies also took steps to remediate the attack, including by implementing additional security measures, conducting network audits, and working with cybersecurity experts to identify and remove any remaining traces of the attack.