Replay Attack and Insider Threat

Hacker runs malicious code and has someone on the inside assisting either knowingly or unknowingly. It seems more like the latter. Hacker is aware that defensive strategies are being implemented and engages in "temperature checks" to see how far along dev team is in patch.

I have several questions. First, how do you convince an engineer or analyst with very strong beliefs that the person they are communicating with is the adversary? It seems like a bait and switch of …

attack aware code cybersecurity defensive dev far hacker insider insider threat malicious patch questions replay strategies team temperature threat