https://www.zdnet.com/article/microsoft-fireeye-confirm-solarwinds-supply-chain-attack/
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
A hack initially corrupted a Solarwinds file, after which, that corrupted Solarwinds file had/has been installed on various Windows OS based machines as a part of routine updating.
The hacked file hatches, you might say, active hack commands that find certain files and deletes those certain files.
The hack tries to hide its tracks, and then force a reboot of the Windows OS based machine.
It is a cover-up.