4 ms·

already known means everyone that knows can also do it

• stonepresto 3y ago
  Threat intel and analysis is just like any other analysis, it is taking a heuristic approach to finding answers. Can it be bypassed? Yes. Are the researchers whose entire company hinges on the correctness of their analysis doing their absolute best to attribute the attack to a threat actor? Yes. So to your point, somebody could indeed reuse malware or attempt to replicate it. However, the researchers are likely analyzing the disassembly and bytecode, and replicating complex malware to perfectly imitate a known family of malware is exceptionally difficult and statistically very unlikely. This is how threat intel is able to make any sort of claim of attribution.
• Thorrez 3y ago
  In this case it was a modified version. Meaning the attackers have access to the source code. Not everyone has access to the malware's source code.