I have mixed feelings about this. I agree with him that if the SVR specifically targeted a particular organization with a specific goal in mind, it wouldn't rea

I have mixed feelings about this. I agree with him that if the SVR specifically targeted a particular organization with a specific goal in mind, it wouldn't really matter if they had weak passwords or not. OTOH, I think it's not out of the question that one or more organizations (intelligence agencies, criminals, etc.) found the password and took advantage of it more as a "let's see where this thread leads" type of opportunistic attack, and all of the downstream consequences only happened because of that. I've never worked for an intelligence agency, but I've been a professional penetration tester for about a decade, and when I go after an organization, that's typically my approach: find the weakest links and start following them to see where they go. In a complex environment, usually that leads to control over everything sooner or later. Edit: just to clarify that last paragraph, what I'm getting at is that if I imagine myself in the shoes of an intelligence agency, the "organizations" I'd be going after would be foreign countries. I'm sure in some cases it would make sense to go after specific businesses of interest, but in the absence of legal restrictions, I'd be looking for the weakest links in entire industries that supported those countries in some way, not necessarily picking a specific business and targeting them. There are quite a few companies out there that make systems monitoring and administration software that would provide similar levels of access to a wide range of organizations if their build chains were compromised. The one that was compromised was the one that also had a publicly-exposed update server with a password that could have been obtained in at least two different ways.[1] Coincidence? Perhaps, but I don't think it's fair to just take it off the table. [1] Accidentally exposed in a public GitHub repo for many months, as well as being easily guessed. Either alone would have been enough. Both being true seems to me to make it more likely.