If you were actually interested in evidence you'd be able to find it, as I have, in a minute or two of following links. For example: https://www.cisa.gov/news-

If you were actually interested in evidence you'd be able to find it, as I have, in a minute or two of following links. For example: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... https://attack.mitre.org/versions/v13/techniques/T1021/004/ https://attack.mitre.org/versions/v13/techniques/T1021/004/ > G0098 BlackTech BlackTech has used Putty for remote access.[2] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt https://symantec-enterprise-blogs.security.com/blogs/threat-... > The Threat Hunter Team at Symantec, a division of Broadcom (NASDAQ: AVGO), has uncovered a new espionage campaign carried out by the Palmerworm group (aka BlackTech) involving a brand new suite of custom malware, targeting organizations in Japan, Taiwan, the U.S., and China.