Thread by @juanandres_gs

@1njection I agree with your general sentiment but in the interest of pedantry—
-Regin is your main 4 Eyes APT
-Equation group is (sort of) your missing eye
-Lamberts/‘Longhorn’ == CIA
And then there’s a few presumably western outliers that haven’t been attributed (ex: ProjectSauron)

@1njection Some resources for the missing nuance in my reply—
epicturla.com/previous-works…
epicturla.com/previous-works…
And for one of the few instances of regin+equation code together itw—
epicturla.com/previous-works…

@1njection To your larger point, you’ll notice that there’s very little follow up on any of these. There’s a complex calculus in the EDR/AV industry on whether to report on ‘friendly’ ops. I understand if they choose not to publish reports but imo intentionally not *detecting* is fraud.

@1njection The best ex to cut through this perverse logic is the shadowbrokers leak. Few companies were prepared w detections or even understanding of the tooling. And I always wonder… had someone seen an unauthorized use of DoublePulsar itw pre-leak, might NSA have known it was coming?

@1njection The TI industry is a form of voyeuristic counterintelligence layered on top of detection products. It’s our job to detect these things and we have a choice as to whether we can stomach a public vs private report (considering well being of customer + health of business).

@1njection That said, if you choose not to detect ‘friendlies’, you should disclose that to your European and Middle Eastern customers before contract signing and see how that goes. ‘Global companies’ playing provincial tactics.