STORYTIME: I once worked an IR case which ended up being an org substantially compromised by an advanced adversary when an employee was spear phished on his *personal* email using pretext surrounding his previous job at another company. He was logged in on his work PC.
The org that paid a boatload for IR and had to do lots of cleanup was never the intended target. They were just an unintended victim whose system was exploited though webmail as part of a campaign against an unrelated company.
The adversary still did extensive recon, password theft, and moved laterally through their network because they likely didn’t know where they were at first, and once they figured out where they were, likely decided it was a windfall to have a foothold somewhere else. Opportunism.
Sometimes adversaries work hard to get a foothold on a specific network. Sometimes initial access randomly falls in their laps. 🤷🏻♀️🍸
