At least some of the DNC users who had VPN access (which, presumably terminated "behind the firewall") had local Administrator rights on the PCs they used [1].

At least some of the DNC users who had VPN access (which, presumably terminated "behind the firewall") had local Administrator rights on the PCs they used [1]. Getting one of those people to load malware and piggybacking on their VPN connection (letting them enter 2FA if there even was any) was likely a cinch. There's nothing that I've read anywhere that makes me think the DNC was any kind of difficult target to compromise. Likely their information security posture was on par industry norms for small office networks-- absolutely terrible. [1] https://wikileaks.org/dnc-emails/emailid/8763 https://wikileaks.org/dnc-emails/emailid/8763