3 ms·

Without having read the full PDF report [0], the summarized version [1] makes the allegations seem quite weak. It comes down, seemingly, to the fact that a PLA

by antsar 11y ago

Without having read the full PDF report [0], the summarized version [1] makes the allegations seem quite weak. It comes down, seemingly, to the fact that a PLA domain name appears in the malware. Maybe I'm missing something. [0] http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_Threa... [1] http://www.threatconnect.com/camerashy-resources/ http://www.threatconnect.com/camerashy-resources/

huac 11y ago
Looks like PLA domain shares name with probable PLA employee social media handle. And the social media accounts were deleted immediately after the WSJ called the guy. It seems pretty likely there is some PLA connection, though not necessarily to this particular guy - no way of knowing that a buddy didn't steal his handle for use elsewhere (seriously, not sharing the same hacking handle and the same personal username should be Tradecraft 101)