It was mos likely not targeted. The fact that theh forked up the cash for yubikeys is the only thing impressive everything else is standard incident response.

It was mos likely not targeted. The fact that theh forked up the cash for yubikeys is the only thing impressive everything else is standard incident response. This seems to me like a credential harvesting campaign. Most likeli there is a trojan app that was used which used a list of contacts to spread. It noted that the employee's families were also contacted, this tells me CF does BYOD for mobile phones. I make a point out of not using my personal phone for anything work related because of this and many other reasons. Not only should companies pay for and manage employee's work phones, using a personal phone for work reasoms should be disallowed. Work phones can be restricted to not have unapproved apps. While yubikeys are phish proof, the attackers could habe instead asked users to download an authentication app which would steal cookies to bypass yubikeys by letting them login to the right CF portal but in a trojanized in-app browser.