So far, we haven’t been able to trace back to the initial compromise vector in the campaigns seen in our telemetry.

They hypothesize that attaching a compromised USB drive to an air gapped system is to blame. That seems to be a well known vector at this point. Does it matter much what tool is used to copy data once it’s in?

Early days is one thing, but if this is the entirety of the code

# WIP

Then there isn’t much to have a discussion about…

TL;DR: Magnets. China makes almost all of them so any time we see something that might replace rare earth metals we get excited. In this case because a group made improvements to our ability to synthesize tetrataenite, an iron-nickel alloy, by adding phosphorus.