- This wasn't a test. Drawing this kind of attention to a test would be dumb, this doesn't look dumb.
- This was probably the "main event". Considering I'm yet to see reports of anything stolen, it would be either hard to detect/miss _or_ cannot be reported as such.
- My guess is that they cut connectivity to the target, *or* forced it to be routed through something compromised. If you have 4 connections, you only need to sniff one if you take the other 3 offline.
- Alternatively, what kind of service gets vulnerable (ish) if connectivity is slow?
I _really_ think this was _one_ step in a much larger and very targeted plan.