Who else is thinking these initial compromises were carried out with the help of an person inside?
Me. As I posted earlier, they themselves compromised part of their own infrastructure by accidentally exposing their update server credentials on GitHub. Getting the malware actually signed is an entire different story, of course.
