Ok so if the solarwinds compromise was used to also compromise O365 then this is a single institution that wanted to target certain orgs. That would in my opinion be A. Very high level B. Be a huge fucking gamble with massive payoff. C. Be an act of digital war. In terms of retaliation for digital wars I don’t believe violence is an answer unless the goal of the initial attack was to cause physical harm to people through data like the OPM hack in 2013-2016. I would financially cut off all ties to said country and block all travel, shipping, and business. If the hack was used to source information to kill Americans I would sink their Navy, cargo ships and imprison all of their foreign nationals with government ties. Fuck around find out 2 whiskeys in check me at 4.
Yeah that’s the gist they probably got some of the rarer one off tools but being that it was a red team kit they probably got a more automated version of kali or parrot Linux. I can’t imagine them using zero day exploits to test a client’s infrastructure. Now if they are in the business of developing zero days then yeah someone probably got some things.
From what I’ve read it looks like the Office 365 attack was more confined in terms of system compromise and you are right you could try and elevate access through trusted phishing, but that is also how you get caught. If Fake Tom emails Jan a stupid phishing email but they sit next to each other and Jan asks Real Tom about the email that hack is done and over with. Also if you are taking large amounts of files from a O365 system you’re going to get noticed at some point.
Pure speculation. What ever nation makes the Solarwinds Orion hardware, my money is on China for this one but Daily Beast is saying Russia so probably not Russia. This isn’t a regular hack, to gain access to a manufacturer of hardware, to compromise equipment that maps networks and analyzes other network hardware performance is pretty genius. They in effect created a vulnerability in hardware that is fairly well trusted in the industry. Like if the KGB turned your mom into a whore, you’d be shook.
The Office 365 attack is just another attack. Microsoft is a big target and the US government is a big target. My guess is that because it targeted the Treasury and National Telecommunications and Information Administration it could be anyone. China because of trade negotiations and 5G policies, Russia or Iran because of sanctions. Roll of the dice on that one.
Yeah I’ve been waiting for at least a second source on this one considering the original is some dude said a thing. Plus raided and helping investigate look very similar when law enforcement walks into a building and you can no longer see them. Sorry guys but Jim Hoft is usually right when he copies a good source but trash when he heard from a dude.