@AmbianceAsunder I mean, given the listed sample of a state-sponsored attack, we can assume the attackers have some basic project management skills and being able to collect both #OSINT and mobilize local assets to collect #SIGINT on street level.

• Not to mention none of the revealed info indicates they could've done it with like #OpenStreetmap / #GoogleMaps and a simple #notepad at hand.

After all, they most likely only realized that #WiFi-connected / authenticated devices are exempted by having collected #INTEL on the targeted org's employees and their workflows.

• Making me conclude they had access to employer handbooks and IT documentation via a unclassified employee. But they couldn't risk have said #insider / #UC blow their cover by i.e. smuggling in an unathorized #device or sth.

It would however make sense to have someone inside as a #canary even if they ain't in #IT nor have any privilegues…

• After all, depending on the organizational size it's a statistical inevitability to have privileged access...

https://www.youtube.com/watch?v=T4w6rloFpCI