I don't think the attacker saw the systemd change at all personally. The way the exploit was setup, they could have pivoted to targeting basically any applicat

I don't think the attacker saw the systemd change at all personally. The way the exploit was setup, they could have pivoted to targeting basically any application server because there's so many interdependencies. python, php and ruby could be targeted because liblzma is loaded via libxml2 as an example. Gaining trust for linux kernel commits would have just let them continue maximizing profit on their time investment. >particularly if the attacker intended to target embedded systems (such as military transport vehicles [6]) Said vehicles aren't networked on the public internet and from experience in this particular sector, probably haven't been nor will be updated for decades. "Don't break what isn't broken" applies as well as "military doesn't have a budget to pay defense contractors $1 million to run apt-get update per vehicle".