That criticism is really lacking. The biggest evidence is that it was an X-agent variant that used a known APT 28 IP address as its C2. The author's argument ab

That criticism is really lacking. The biggest evidence is that it was an X-agent variant that used a known APT 28 IP address as its C2. The author's argument about APT groups wanting to switch IP addresses around as quickly as possible doesn't make sense. If you're using an IP-address-based C2 you want to hold onto it for as long as possible, because the second you give it up you lose the ability to control all your malware. Reusing infrastructure is very common, and is not at all a sign "sloppiness" as the author claims. APT groups generally don't care if you can correlate their different attacks, because it doesn't actually affect them. And having a complete separation of all your infrastructure for every attack is time consuming and has a serious burden of effort that limits the pace at which you can attack, all for very little gain. Infrastructure gets reused all the damn time, as does malware, and even certificates. Source: I'm a member of the security research community.