My understanding is he used the carcass of another AV tool to bypass signature requirements which is understandably grey (there's an argument for it being trans

My understanding is he used the carcass of another AV tool to bypass signature requirements which is understandably grey (there's an argument for it being transformative, IMO but IANAL).