3 ms·
Deletion could be triggered by their systems determining that someone is trying to research their malware/infra.
by 55555 4y ago
Deletion could be triggered by their systems determining that someone is trying to research their malware/infra.
- bryanrasmussen 4y agoright, that's what I figured but the phrasing of the article made me think the assumption was otherwise.
- CuckooExe 4y agoThanks for pointing that out! I'll try to update my phrasing to make it more clear. At the end of the day, I don't have definitive proof of anything, however, I'm fairly confident that it was taken down in response to one of two things: a) the payload was downloaded and executed (technically), or b) I was badgering their domain with requests to re-download it. If it was a), then this might indicate a more advanced adversary who has the TTPs to support this. If it was b), which hints at something more reactionary, then I'm going to guess the adversary was slightly less advanced. Lmk if you have more questions!