> [The malware contained] an IP address that had been used to launch operations linked to the malware. > That address was registered to the Central Scientific

> [The malware contained] an IP address that had been used to launch operations linked to the malware. > That address was registered to the Central Scientific Research Institute of Chemistry and Mechanics in Moscow, a government-owned organization with divisions that focus on critical infrastructure and industrial safety. Ironic, sounds like they also have the job of subverting critical infrastructure and industrial safety.