3 ms·

I wonder how Google determines that an attack is government-backed? They must have some incredible intel.

• londons_explore 8y ago
  They run all the attachments and downloadable files in an email in a virtual machine and see where the malware connects to. Turns out many governments do attacks on a lot of people semi-automatically, and use a handful of command and control servers, so their attacks are fairly easy to identify.