I think that's a good summary. Also, it's easy to imagine the SVR poking at all companies which sell high-trust applications[1] to many government agencies, and

I think that's a good summary. Also, it's easy to imagine the SVR poking at all companies which sell high-trust applications[1] to many government agencies, and running with the ones[2] that worked. Regarding whether the password thing was a coincidence, I wouldn't be surprised that, if other large enterprise software companies were severely hacked, similar stories surfaced. That doesn't mean it's a coincidence, of course, but may mean that this is average among enterprise software companies. One takeaway here is that software companies shipping trusted software to third-party networks have an exposure more like Google or the Federal Reserve, not like other software companies. That's not how (a lot of) the software industry has acted. [1]: NMS, systems management, facilities management, possibly CRM [2]: Where one was detected (because the attackers chose the wrong target in FireEye), others have probably occurred and/or are active now. While this was very sophisticated, it wasn't Stuxnet (https://blog.erratasec.com/2021/02/no-1000-engineers-were-not-needed-for.html https://blog.erratasec.com/2021/02/no-1000-engineers-were-no...).