The GRU's Disruptive Playbook

> Going for the GPO: Creating persistent, privileged access from which wipers can be deployed via group policy objects (GPO) using a tried-and-true PowerShell script.

So they specifically target Windows machines only? Or is that just the biggest attack vector and therefore easiest to do repeatedly?

Now part of Google Cloud My thoughts and prayers go with Mandiants. GC is a division with a history of laying off experienced people haphazardly to replace them with cheaper staff because it makes their managers look good in the short-term.

Is anyone else annoyed by the page hijacking scrolling when JS is off?

I skimmed this.

I had to look up "wiper".

TL;DR the GRU first find a vulnerability, and break in; then they consolidate their bridgehead; then they create havoc, either by destroying static data, or by sending bogus information using bogus personas.

This doesn't sound like something I didn't already know.