I'm not in netsec, but i'm still a little fuzzy on some details here: 1)what's the evidence that this is tied to/from the off the shelf core-impact product? us

I'm not in netsec, but i'm still a little fuzzy on some details here: 1)what's the evidence that this is tied to/from the off the shelf core-impact product? using a similar api call? a controlling server is used? 2)other than the target being an israeli aerospace firm and payload pretending to be military in nature (im guessing to generate curiosity, how are 'nation-states' involved? EDIT: maybe answering my own question 1. a "Campaign" identifier is a variable found 2. lure document exists elsewhere and has been seen targeting multiple nations over years. at academics and defense orgs.