Agency says it has “evidence of additional initial access vectors” besides SolarWinds’ Orion software. Source