[KirillPanov]

... or they hacked a (low-value, low-security, easy) SolarWinds customer first.

Then they hacked SolarWinds. Then they used SolarWinds to hack the real high-value target(s).