It has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. It also collected a list of computers using specific software as part of its targeting efforts.