SUNSPOT was another malware vector in the Solarwinds hack, and this article goes deep into how it was used to replace MSBuild.