My guess is that some social engineering is involved. That's how the Soviets hacked the Manhattan Project in the 1940s: planting spies, and/or bribing scientist

My guess is that some social engineering is involved. That's how the Soviets hacked the Manhattan Project in the 1940s: planting spies, and/or bribing scientists involved in the R&D. Another guess is that, because so many defense contractors and manufacturers are interdependent these days -- almost nobody designs or builds complete systems anymore -- they are tied to each other through communication channels and networks. A really good hacker-spy could piece together bits of information from Source A with information from Sources B, C, D, and discover or infer vulnerabilities from there. Air-gapping does seem like an obvious choice, however, and I'm legitimately puzzled if it's not being done for the most sensitive design systems.