That's how CNO exploitation works. They generally can't report; their adversaries are recording their own networks, and will retrospectively detect intrusions.

It's their SOP. See: eternal blue. https://en.m.wikipedia.org/wiki/EternalBlue