Perhaps most striking, consistent throughout the indictment, is the entirely inconsistent application of digital tradecraft in LAZARUS' operations (1/6)
Across ops with different goals in different AORs, the DoJ was able to identify source range IPs (both NK and Chinese) connecting to various elements of operational infrastructure and personas. Proxy and cut-out infrastructure existed, but it was used unevenly (2/6)
