"Considering the extreme complexity of the Regin platform and little chance that it can be duplicated by somebody without having access to its source codes, we conclude the QWERTY malware developers and the Regin developers are the same or working together."
"Extreme complexity"? This from people who have just reversed engineered both of them. Modest, huh?
OTOH, it is to be hoped that their claim is correct. Part of GCHQ's job is to develop stuff like this so one would hope that they were investing at least some of their budget in such things and getting usable products out of it.