Revising my postulate, hope to have a working theory soon:

Colonial was hacked, by Ukrainian Biden operatives. The exploit of the single factor authentication process on a "legacy VPN" testimony by the CEO sounds plausible, and he keeps deferring to others. Does not mean that there were not (IT) moles (legacy VPN). He bypassed FBI advice and paid the ransom, after consulting lawyers for fear of violating federal law by paying ransom to sanctioned entities. He sounded legit.

Coupled with the Deputy AG presser from yesterday that Yahoo published changed my mind. There was no foreign cooperation, and a single warrant by a U.S. judge… implies the seizure was entirely U.S. venue / jurisdiction. It really has a "non-Russian gas tariff" feel to it imo. iirc, Ukraine is one of, if not the leading non-state area of hacking prowess.

This would also explain the rush to msm the "ransom recovery" to further the "Russia did it" narrative, "end of storying" any possible ongoing investigation that might lead to arrests.