A supply chain attack against IT company SolarWinds has exposed as many as 18,000 companies to Cozy Bear's attacks.