It is common knowledge that VirusTotal analyzes and shares submitted files with security researchers. The only blackhats who use VT to check their own files are

It is common knowledge that VirusTotal analyzes and shares submitted files with security researchers. The only blackhats who use VT to check their own files are those who are either incapable of setting up their own multi-scanning systems or paying to use one of the many "underground" services[0][1] that offer similar functionality and do not share submitted files. The fact that allegedly state-sponsored groups from China did not use these services is yet another example of the striking difference between their apparent lack of operational technical proficiency and the amazing results they achieve. [0]: http://krebsonsecurity.com/2009/12/virus-scanners-for-virus-authors/ http://krebsonsecurity.com/2009/12/virus-scanners-for-virus-... [1]: http://krebsonsecurity.com/2010/04/virus-scanners-for-virus-authors-part-ii/ http://krebsonsecurity.com/2010/04/virus-scanners-for-virus-...