Thanks for the link. I've been trying to do a good faith evaluation of the evidence myself about APT28/29 being involved in the DNC hacks and the link between t

Thanks for the link. I've been trying to do a good faith evaluation of the evidence myself about APT28/29 being involved in the DNC hacks and the link between them and GRU/FSB. I'd actually come across this before and it raised a question for me. I don't know if you'd be in a position to answer? Basically, how do we know APT28 is one group? It seems like it's defined by the use of certain malware, but is it possible that the malware is "out there" and several different groups are all using it, with different motives? For example, in the PDF your link points to: > APT28 has targeted a variety of organizations that fall outside of the three themes we highlighted above. However, we are not profiling all of APT28’s targets with the same detail because they are not particularly indicative of a specific sponsor’s interests. They do indicate parallel areas of interest to many governments and do not run counter to Russian state interests. Other probable APT28 targets that we have identified: > • Norwegian Army (Forsvaret) • Government of Mexico • Chilean Military • Pakistani Navy • U.S. Defense Contractors • European Embassy in Iraq • Special Operations Forces Exhibition (SOFEX) in Jordan • Defense Attaches in East Asia • Asia-Pacific Economic Cooperation (APEC) • Al-Wayi News Site I started thinking about this because all the evidence pointing to APT28 being involved in the DNC hacks is because the DNC hacks showed evidence of using the malware attributed to APT28. But if APT28 is defined by the use of the malware, it's sort of true by definition. But that doesn't mean there's a single, coherent group behind it, necessarily.