What strikes me:
- amount of data, 10PiB, is bonkers;
- apparently this was happening over half a year;
- apparently the dataset includes military secrets.

CNN annoyingly keeps switching between "a hacker" and "the group". This is a great example where "hacker" should not be used at all – ignoring the obvious mis-use of the term (hacker is not the same as cybercriminal), "hacker" makes it seem as if it's some lone activist somewhere.

It's not. Not with 10PiB of data exfiltrated over 6mo.

🧵

Back-of-a-napkin math, renting enough disk space to store 10PiB of data would cost well north of ten thousand EUR a month.

And if the threat actor used their own infrastructure, who are they if they can store 10PiB of data for months on end? Have you seen the prices of hard drives recently? 👀

This is not Snowden walking out of the NSA with a thumbdrive. This is a sustained, long-term, well-resourced campaign.

Talking about "a hacker" in this context is ridiculous.

🧵

@Viss @madduci

I'm ready.