Yep, Amn is Iran’s Kaspersky (Padvish AV) this was most likely a TLA level actor operation. The overall analysis is a bit on the shallow side there might be mo

Yep, Amn is Iran’s Kaspersky (Padvish AV) this was most likely a TLA level actor operation. The overall analysis is a bit on the shallow side there might be more things there that they didn’t uncover. The odd thing is that the malware creates a file name basically called “fake firmware” that seems a bit too amateurish for the usual suspects… Might be KSA’s NSA for hire level op.