blushinggilda If your point is that the assumed adversary just received a blueprint how to build an exploit chain - agreed,
This "help" for the "attacker" is not as big as someone would think, especially against a state actor.
I am thinking about how I would do it for myself, but I never put a state actor in my threat model in the past.
Let's start with a reality check.
I always took for granted I will never be able to beat an entire country, because they have too much time and money.
State actors could use things that opportunistic hackers or cybercriminals don't cannot, like paying a truck of money to trained people, or buying new exploits.
A state actor might have enough time/patience to wait for an encryption becaming obsolete to newer technologies/algorithms; this means that if they get a copy of the target traffic today, they will be able to decrypt it sooner or later.
I would dare to say it is not possible to defeat an attacker this big, but I will try my best to examine the situation as if I had to do it for myself.
Ready for a wall of text?
First, some considerations:
We already thought about the amount of money they can throw at resources (not only machines, but also menpower) and how they can wait long time to gain advantages / find a way in.
Also, a state actor might have some legal leverage, which is something no technical skills could stop.
If they send police at the target's door taking away the equipment, they might also have physical access to the devices. I am not sure if this is a possibility in this specific case.
Some attack vectors I can think of (based on what happened in the past) are supply-chain comprimission, zero-day exploitation, endpoint compromission / network attacks...
On the supply-chain I am thinking about SolarWind (proprietary software), hacked apparently by a state actor and could grab a lot of information before they could tell they have been hacked.
Also, in the past we saw some open source dependencies mangled... I am thinking about XZ Utils, which would have affect also big projects like OpenSSH (this example also reinforce how state actors can wait years).
Also in this case it seems it might have been a state actor.
The target could decide to go for projects with minimal dependencies (to shrink the attack surface) or give up services completely (For example if you need to sync your contacts, you can do it with a file instead of a 24h service).
I would also segment the environment the most I could. Not only the infrastructure, but also dividing work stuff from personal stuff and so on. Sometimes little things as having different users for different things helps a lot.
This way if a computer/service is compromised, the attack might be confined in a smaller area.
On zero-day exploitation, there's so little we can say. No real mitigation and the attack might compromise Browser, OS, Network... pretty much everything. The only things I would do against this (apart from updating everything, of course) is reducing the reach of the attack by (again) using fewer services as I could. I would basically give up what is not necessary, because the power of the attacker is over 9000. I would also try to use some hardened systems; the target already gave up on QubeOS, but they can still choose something better than a plain Debian or Fedora, like SilverBlue or OpenBSD.
OpenBSD will probably be less restrictive than SilverBlue if the target needs to expose some services, and often it is possible to find working software in the official repositories without having to tinker it too much.
On endpoint compromission we could spend a lot of time, but having an hardened system and segmented network is already a good mitigation. Because the compromission can be a lot of things, I would think more of keylogging and data exfiltration. It's useful to follow the least privilege mindset and maybe starting to use live systems from bootable devices (I am not suggesting specifically Tails, just something similiar) to be sure that malware is not permanent.
On network compromission, nothing much to add, except maybe setting every encryption to the highest possible algorithms... Secude DNS, TLS1.3, stuff like these.
Generally speaking, I would say that part of the defense line would be achieved from behaviour more than infrastructure.
The more online the activity will be, more attack surface will be given.
Sometimes stepping back and going some technology back can help more than newer solutions.
I would say that if I had to insert a state actor in my threat model, I will shut down most of my home lab and rely way less on IT in general.
Moving files online will essentially skip all those vulnerabilities introduced by network and would at least remove every remote access.
Overall, would be better to know what are the needs of the targets before deciding what/how to implement.
These are just very generic considerations and might not be possible to tailor something useful to the target.
Maybe we can start from what services are essential for the target and reason on how to implement them.
As a conclusion (finally lol) I would say that to beat an enemy this powerful I would probably give up some convenience. Security is sometimes counterintuitive or not compatible with needs. Sometimes we have to choose and accept risk or give up a service. If we don't take into account physical coercion, a notepad in your pocket is more secure than a sync service.