I previously tweeted that a prior indictment was ~APT10. I was analytically lazy & wrong. So I want to highlight parts of the actual #APT10 indictment from today. First, DOJ used the term APT10. I can't recall other cases where DOJ has used an existing group name, can you? (1/n) 
They also mentioned other group aliases. A reminder to consider @RobertMLee's valid points about how group names can't be exact overlaps due to different visibility and analysis methodology between companies (sans.org/webcasts/threa…). (2/n)
Noteworthy that the actors were associated with a company acting "in association with" MSS. This made me think of @Jason_Healey's Spectrum of State Responsibility (atlanticcouncil.org/images/files/p…). (3/n)
Victims spanned a wide range of sectors. A good reminder that while it may make sense to focus on threats targeting your sector, some don't specialize. (4/n)
Wow, that's a lot of machines and data. I don't recall seeing this breach acknowledged previously - admitting compromise of Navy systems is notable. (5/n)
Emailing employees of a helicopter manufacturing company about aircraft antennae seems pretty targeted. Stuff like this puts the "advanced" in APT because this requires some level of planning and coordination, not just spray and pray. (6/n)
Use of dynamic DNS domains isn't new, but worth remembering. Lots of good research on how to detect them. (7/n)
(Just noticed @cglyer did a similar thread. I think we have different perspectives so I'll continue. His thread is good.) (8/n)
Wow, NASA and Lawrence Berkeley National Lab? I'm hoping this just normalizes that many orgs are victims, rather than finger pointing and blaming them. (9/n)
1,300 domains! This is specific evidence to point toward about why tracking domains isn't sufficient. At that volume it would be incredibly tough to get them all, and may not be worth the time. (10/n)
I wonder how many MSPs are actively monitoring RDP connections to their customers for anomalies. Worth asking if you use an MSP. (11/n)
Again, not new, but a great example of actors abandoning infrastructure after it's publicly reported. A reminder that can be a strategy to make them change infra, but also a reason to hold back info (though that pains me to say because I'm a huge fan of info sharing). (12/n)
In summary, not a ton new about TTPs (there were great reports previously, see attack.mitre.org/groups/G0045 for some of these), but victims were quite interesting. Strategic aims aside, I'm happy how this indictment backed up the good work folks from this community have done. (13/13)
How could I forget the FIN7 indictment?!? Thanks @instacyber @a_tweeter_user @kyleehmke. Need a vacation. Is this the first state-sponsored group name in an indictment, or am I forgetting another one?
