Seriously! Here is technical analysis of one of the malware used. http://researchcenter.paloaltonetworks.com/2015/07/unit-42-technical-analysis-seaduke/ http:/

Seriously! Here is technical analysis of one of the malware used. http://researchcenter.paloaltonetworks.com/2015/07/unit-42-technical-analysis-seaduke/ http://researchcenter.paloaltonetworks.com/2015/07/unit-42-t... Why does everyone thinks that only Russians can write such a malware, that too in python! Also, does it dawns on anyone that anyone can actually take this malware up and reverse engineer it and repurpose it. All it takes is changing one JSON blob embedded in the code to point to your own servers for CNC, use your own AES IV/Key. Also, I find it funny that they use embedded time stamps and resource locales as a proof of anything. Didn't anyone ever use Resource Hacker or 'strings' command? Is it really this hard to scrub or falsify timestamps in a DLL/EXE? The most damning proof would have been some SSL certificate reused in a known compromised server for CnC. I heard rumors around it but nowhere in the analysis this was highlighted or discussed.