It does look like the companies development and distribution servers have been compromised
Which is the nightmare scenario for Windows update users.
"Set up a shadow file system in the registry"
WTF?
Would that be even possible in any other main stream OS (that didn't have an everything-and-the-kitchen-sink "database" in it)?