Are these source or destination IPs?

[zeroepix]

I'm a bit unclear whether these IP addresses are the ones where the backdoor was installed - the compromised systems - or where compromised systems were being directed to. Could you please clarify?

[bambenek]

These are destination IPs

[zeroepix]

Interesting. In trying to figure out the applicable risk, even if a company didn't use Solarwinds Orion itself, if an upstream provider (e.g. a cloud or data center) used them, could it have been affected anyway?

[bambenek]

An upstream provider could have been affected but it depends on the service as to what could impact downstream victims. See Azure, VMware news