A firewall usually needs to set up as a local "VPN". A mobile data saver app also needs to run as local "VPN". Then a real VPN starts up and knocks off either of the first two already up and running.

I find this article quite difficult to comprehend, we go from rooting firewalls to somehow magically obtaining Microsoft active directory secrets? There’s no logical flow to how attackers are jumping ...