> The vulnerability was patched and the red team's initial compromise was contained, so they targeted them with phishing, owned their domain controllers, then maintained access for months while pivoting to partner organizations, then published a public report.

You're missing a few steps between the pivot to partner organizations and the report. The public report was made on 11 July 2024. They revealed the breach to the target last year, June 2023, and then began a collaboration effort at that point, running through September 2023. They also don't name and shame in this public report, we don't know what the target organization was.