Agree. Also: "A malicious software class was included among many other legitimate classes and then signed with a legitimate certificate," the Windows maker said

Agree. Also: "A malicious software class was included among many other legitimate classes and then signed with a legitimate certificate," the Windows maker said. The resulting binary included a backdoor and was then discreetly distributed into targeted organizations." - which means that somehow a signing certificate must have been stolen or reverse engineered. Not simple.