This leaves me curious to know how they connect the dots to piece together who's behind the attacks. I found this on another post but it doesn't go into much de

This leaves me curious to know how they connect the dots to piece together who's behind the attacks. I found this on another post but it doesn't go into much detail: "Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures." It sounds fascinating if anyone has further reading on the subject! (Not just for HAFNIUM but in general how to put together a profile of an attacker.) https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ https://www.microsoft.com/security/blog/2021/03/02/hafnium-t...