Dude gave anyone looking for forensic clues a layup

would lock every employee out of their accounts if his credentials were ever revoked, and named the code IsDLEnabledinAD, as in “Is Davis Lu enabled in Active Directory.”

That’s kind of an easy figure out: look for all the D.L.s in the company and work from there. But then

investigators subsequently found the source code for this program on an internal development server in Kentucky, and that Lu’s user account had been used to execute the malware on the production box. Lu was also the only member of his team who had access privileges for that dev machine.

This guy left an easy forensic trail.

There was something amiss before. Nobody starts compromising the system just a few months before getting fired.

he was demoted

That also indicates there’s more to the story than it seems.

i was wondering if it was possible lol