ANSSI describes they collected ~300GB of compressed logs for network logs (TACACS), Internal wiki logs (Apache logs), Firewall logs (ASA), Windows logs (Active Directory, Desktops & Servers) — in addition of ~13TB copy images of harddisk, memory (RAM) and embedded devices of the main target of interests. The attacker came back later on, this time, with a compromised third-party account to connect through the TV5Monde VPN before compromising it on the 6th February 2015 over a one week period, and discovered two machines (ROB1 & ROB2), after scanning its internal network, that were Windows machines managing the cameras.