> Why are we just hearing about it now? Once malware is identified properly antivirus firms will usually go through their detection archives and pull out earli

> Why are we just hearing about it now? Once malware is identified properly antivirus firms will usually go through their detection archives and pull out earlier hits. The reason why they don't see them sooner is because they get tends to hundreds of thousands of new threats each week and don't have time to go through each one. Mikko from F-Secure also reported on Twitter that they found Regin[0]. The same thing happen with Stuxnet, and just about every other malware - it is why these firms will keep and check the archives of new detected threats. As for your general suspicions, this is endemic with infosec since there is a natural conflict of interest where those doing the research and reporting on it are also selling solutions. If it makes you feel any less suspicious, the research departments within these antivirus firms are generally isolated from parts of the companies involved in sales and marketing. They are usually small teams that just go out and publish information on cool things they find - although there is often a race to be the first to dissect and publish the details of new malware (which is why you wouldn't sit on knowledge of a new threat). [0] https://twitter.com/mikko/status/536624310035939328 https://twitter.com/mikko/status/536624310035939328