If entrapment is unprotected in a relevant jurisdiction, seized domains/servers could be used to disrupt or even unmask actors. Release a new dropper and make t

If entrapment is unprotected in a relevant jurisdiction, seized domains/servers could be used to disrupt or even unmask actors. Release a new dropper and make the payload build tool malware itself. Now these actors can't trust what they get from each other, even if they trust the person who is supposed to be in control of the service. That would be a radical departure from the status quo of boasting loudly and plastering seizure pages up everywhere, and the suggestion here is that they are trying different things.