It's speculation as I stated. But it's really not a "leap". The whistleblower's claim: > They were able to get cryptographic secrets for single sign-on cookie

It's speculation as I stated. But it's really not a "leap". The whistleblower's claim: > They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration And what Ubiquiti has further stated: > we have well-developed evidence that the perpetrator is an individual with intricate knowledge of our cloud infrastructure. So someone with intricate knowledge of their infrastructure and access to their source code + signing keys, is doing what exactly with those VMs? I'm not trying to 'prove' that the firmware is compromised. We can't do that with the information we have. I'm just highlighting strong evidence that the possibility needs to be thoroughly investigated.