This is certainly a serious issue, but a few aspects of this article are very strange. > Worse, the assault, which has never been reported before, was not spot

This is certainly a serious issue, but a few aspects of this article are very strange. > Worse, the assault, which has never been reported before, was not spotted by some of the nation’s leading cybersecurity products, the top security engineers at its biggest tech companies, government intelligence analysts or the F.B.I., which remains consumed with the WannaCry attack. > “The world is burning about WannaCry, but this is a nuclear bomb compared to WannaCry,” Mr. Ben-Oni said. “This is different. It’s a lot worse. It steals credentials. You can’t catch it, and it’s happening right under our noses.” This attack and WannaCry use the same exploitation vector (EternalBlue). It seems that his company was targeted with a custom payload, which is definitely unfortunate, but that is not related to the exploit itself, it is just another form of custom code being used to perform further actions (Instead of simply encrypting files as WannaCry was doing). This is probably even easier for an attacker since there is now even a Metasploit module for MS17-010. > The attack on IDT went a step further with another stolen N.S.A. cyberweapon, called DoublePulsar. The N.S.A. used DoublePulsar to penetrate computer systems without tripping security alarms. It allowed N.S.A. spies to inject their tools into the nerve center of a target’s computer system, called the kernel, which manages communications between a computer’s hardware and its software. This is not a "step further" though. DoublePulsar is the implant injected EternalBlue and was certainly used in WannaCry. I am not sure why they had not even taken the time to try to verify this, even the WannaCry Wikipedia page states this (https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack). Again, this is the same exploitation vector and same implant, but with a modified payload to specifically target IDT it seems. > For his part, Mr. Ben-Oni said he had rolled out Microsoft’s patches as soon as they became available, but attackers still managed to get in through the IDT contractor’s home modem. This tells me: 1. Even though machines internally were patched, a contractor was allowed to connect to the network with an unpatched machine. 2. If machines were internally patched, how would an infected contractor be able to do damage? I am not clear on this. They might be saying the network itself was not attacked, but rather the attacker was able to login with the legitimate employee's credentials and cause damage that way (In which case, something is very wrong internally if this was possible). I know it is not nice to victim-shame regarding security issues, and I am trying not to do so, but it seems like the story here is phrased in a slightly disingenuous manner. It is essentially this: An IDT contractor with an unpatched machine and privileged network access was targeted using EternalBlue to steal their credentials with a custom payload. It worked. After this, it is unclear if the stated network intrusion occurred because EternalBlue spread (Would not make sense if patched) or the contractor credentials were used "legitimately" (Indicates poor access control and monitoring).