SEC joins hunt for FIN4 attackers

RLY?

"At that time, FireEye had been unable to establish di9rect [sic] evidence that the phishing attack had yielded information to run trades."

Perhaps more direct methods were used. When large amounts of money are available the baddies might not rely on emailed .pdfs and instead do boring old espionage or perhaps both together. People do daft things sometimes like open attachments. They are probably more likely to do that if the attractive operative that has got the mark pissed up claims it has their phone number and address details in it. The remote connection is established ...