Re: Or are they....
They are active and some of the captured binaries have timestamps during business hours in a TZ which is between 2 and 4 hours off GMT Eastwards.
That is all of Eastern Europe, Russia, ex-CIS states, a chunk of the Middle East. They also target a set of targets which are of interest to Russian state.
That narrows them down to an operation which is in Eastern Europe and/or ex-Soviet Union and has the Russian state as one of its customers. It does not automatically equate to supported. Customer - pretty much guaranteed. Supported - we cannot prove that until we have successfully collared at least one perp and keelhauled him until he spits who is paying him.
Biting the hand that feeds IT
