#SolarWinds was an access operation, not an effects operation. Those saying "only an espionage campaign" and assigning early intent to such a large-scale access operation are mistaken. #ThreatIntel #infosec #cybersecurity

Long-term and large-scale supply chain access is an objective for many offensive cyber teams. They want the flexibility to choose when and how to use that access later. Assigning intent to such access is filled with sampling bias #ThreatIntel #SolarWinds #infosec #cybersecurity

A good thought-experiment, if we had caught MeDoc software supply chain attack earlier without NotPetya, it would probably would have been labeled "espionage" as well and some analysts would have applied mirror image biasing to assume "they wanted access to accounting for X"

The fact that there was some espionage conducted in a large-scale access operation doesn't mean it was for espionage only.