Whenever I hear statements like "incredibly complex and sophisticated attack" I'm reminded of the 2011 Comodo (now Sectigo) hack where the company said it had "

Whenever I hear statements like "incredibly complex and sophisticated attack" I'm reminded of the 2011 Comodo (now Sectigo) hack where the company said it had "clinical accuracy" and "likely to be a [Iranian] state-driven attack". Days later, the perpetrator released a "manifesto" (and several other documents) all but confirming that it was the work of a lucky amateur. Moxie (of Signal fame) has a hilarious account of the story in his 2011 Blackhat talk "SSL and the future of authenticity" (starts at around 5:00): https://www.youtube.com/watch?v=UawS3_iuHoA https://www.youtube.com/watch?v=UawS3_iuHoA