What you say is generally true. But we know that the lawyer's AV caught it. I have trouble believing that a law firm has better IT than a police digital forensi

What you say is generally true. But we know that the lawyer's AV caught it. I have trouble believing that a law firm has better IT than a police digital forensic group. I guess one way of determining if it would have been caught by outdated or marginal AV software would be to figure out when the variants mentioned in the article were identified and added to most AV DBs. A project for another day perhaps.