Before "those" conclusions, I find of most interest the previous "Malware Conclusions": "The PHP malware sample they have provided appears to be P.A.S. version

Before "those" conclusions, I find of most interest the previous "Malware Conclusions": "The PHP malware sample they have provided appears to be P.A.S. version 3.1.0 which is commonly available and the website that claims to have authored it says they are Ukrainian. It is also several versions behind the most current version of P.A.S which is 4.1.1b. One might reasonably expect Russian intelligence operatives to develop their own tools or at least use current malicious tools from outside sources." The last sentence is IMHO even stronger.