The SolarWinds attack unfolded over many months, and coincided with governments' latest negotiations to strengthen and clarify cyber norms.