Since 2014, nations with a strong vested interest in Ukraine not falling threw a lot of resources at strengthening the country's infosec. Also, during a kineti

Since 2014, nations with a strong vested interest in Ukraine not falling threw a lot of resources at strengthening the country's infosec. Also, during a kinetic conflict where you're invading, it's often more strategically valuable to lie dormant in their networks than it is to scorch them, a la America sitting inside of Iraq's phone networks and just listening. There's a lot of work being done now to change it [1], but I've heard from multiple cybersecurity grunts in critical infrastructure that they just assume foreign APTs are in their networks. Strategically, why in the world wouldn't they be? There's basically no downside other than burning TTPs. We should damn well expect the NSA to have their fingers in every foreign pot they can reach. [1] To be fair, there was a lot of work before too. But now people are more scared.