[stelfer]

It's a strong statement but it definitely leaves the door open. Given that there's so much at stake I can't imagine a different statement.

On the other hand, if you read the CISA alert[1], it's clear that (1) many industrial targets were compromised, given the ubiquity of the Orion product and the amount of time that transpired; and (2) the attackers had their merry f'ing way with MS products like AD. So at this point I think it would be more surprising if they were not compromised than if they were.

[1]https://us-cert.cisa.gov/ncas/alerts/aa20-352a

[AnimalMuppet]

Are you saying that the attacker's skill with AD indicates that they were able to plant code in AD? Steal the source and learn vulnerabilities from it? Or just that, given that MS uses AD, they were vulnerable too?