I think the fact that they were able to use the attackers own exploit to get onto their dev machine and see the EN/IN keyboard layout was a major flag (along wi

I think the fact that they were able to use the attackers own exploit to get onto their dev machine and see the EN/IN keyboard layout was a major flag (along with the targets of the malware). Having been in this field myself at one time, this is fairly common (self-infection when testing) and why you would never develop or test on an internet facing machine. It's also why you ensure your command and control and all comms are encrypted, keys rotated, expirations, etc. Most people developing advanced malware don't want someone else sniffing around, finding their drops, using their tools, or worse, discovering what's been exfiled and why the target was specifically selected.