IIRC, previous articles (a few weeks ago) stated that Cisco (at least, and possibly others) have known about and been “tracking” this for months but they finall

IIRC, previous articles (a few weeks ago) stated that Cisco (at least, and possibly others) have known about and been “tracking” this for months but they finally announced it publicly because $someEvent was approaching and they were afraid this botnet would be used to disrupt it. (I’m on my phone or else I’d look into this more and give you more specific info instead of vague recollections but, if you (or anyone else here) are interested, this should at least give you somewhere to start.)