Thanks for sharing. You seem to have some knowledge of the APT scene. Can you please elaborate on the following points? - the focus on switches and routers is

Thanks for sharing. You seem to have some knowledge of the APT scene. Can you please elaborate on the following points? - the focus on switches and routers is very pro (did you mean the defenders or the attackers?) - What kind of knowledge is a starting point to hunt these players? I assume very good Linux system admin skills that can protect the whole system well enough to maybe only allow some obscure entries, and then have enough RE/Red team knowledge to know how to focus on these entries. Does it make sense? - How do those APTs operate? I'd imagine there are at least 3 groups of people, group 1 = people who make tools, do analysis, RE and such -- they are the support guys; group 2 = people who directly execute the operations -- they don't need very in-depth knowledge but need to a whole range of knowledge to know where to look at and how to best use the tools; group 3 = blue team who protects the whole facility. And of course there are managers, admins, etc.