The DOJ detected the SolarWinds hack 6 months earlier than first disclosed

If there's any justification for this kind of delay between detecting an intrusion and acting on it, it would have to be giving the government time to investigate, in order to correctly identify the source and means of intrusion, so the right parties were charged and innocents weren't dragged in.

Which, unfortunately, was not the case with Solarwinds. Almost immediately after the intrusion was publicly disclosed, there were a bunch of stories, in both industry outlets like The Register and mainstream ones as august as the New York Times, suggesting that software from JetBrains might have somehow been implicated in the hack -- citing no evidence other than that Solarwinds had bought JetBrains products, and that they were, y'know... one of them furrin companies (though Czech, not Russian -- one wonders whether the FBI knows the Czech Republic is an EU member these days).

  https://www.theregister.com/2021/01/07/jetbrains_solarwinds_accusation/

And yet, when a full technical writeup of the way the build servers got breached was available, it turned out that JetBrains software was not at fault; the hack to the build servers worked at a lower level, and switching to a different build orchestrator wouldn't have changed things at all:

  https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/

So, extra time to investigate didn't keep the investigators from leaking a report that was just false. JetBrains obviously wasn't well served by this -- but neither were the rest of us.

I think the key thing other commenters here are missing is how the compromise at the time did not appear to be anything unusual.

You will notice that network traffic got their attention, not endpoint telemetry. This means they had no idea what process did what. Implants like that do everything in memory, chances are they found some malicious code and weird network traffic but it was on a trial box and they didn't have enough information to figure out what was happening.

This is why in IR we say "the worst thing that can happen during an incident is to eradicate incorrectly" (paraphrasing).

Mandiant being who they are probably had their agents all over and could tell what was happening where (and as they claim, if they were a country, their intel capability would be 5th in the world), but not only that they had access to customer networks which allowed them to get an idea of the scale of the breach.

Lastly, even in infosec, people who don't respond to incidents don't get just how much luck is involved, for threat actors as well as incident responders.

As I recall, someone noticed weird MFA device registration on his account and reported it or something at Mandiant. Had that been ignored FSB would have been very happy for at least a few months more.

They noticed the breach in the trial version and still bought the product. Makes me wonder what would have led to them not buying the product.

The Cuckoos Egg[1] round 2? A bit funny how several decades later, some things just don’t change…

[1]https://en.m.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book)

Amazing the amount of government, industry, and academic coordination that was put in place to fight disinformation. Why can't that same effort be put into cyber and ransomeware security?