<story><title>Apt Encounters of the Third Kind</title><url>https://igor-blue.github.io/2021/03/24/apt1.html</url></story><parent_chain><item><author>mwcampbell</author><text>&amp;gt; Chinese APT malware,&lt;p&gt;Why is it necessary to point out the foreign origin? Doesn&amp;#x27;t that just encourage our innate xenophobia?</text></item><item><author>afrcnc</author><text>From Twitter chatter, this appears to be Chinese APT malware, something related to PlugX</text></item><item><author>motohagiography</author><text>Superb work. The &amp;quot;who&amp;quot; of attribution is more likely related to the actual PII they were after than any signature you&amp;#x27;ll get in the code. Seems like a lot of effort and risk of their malware being discovered for PII instead of being an injection point into those users machines. I rarely hear security people talk about  &lt;i&gt;why&lt;/i&gt; a system was targeted, and once you have that, you can know what to look for, inject canaries to test etc.</text></item></parent_chain><comment><author>fouric</author><text>It should be pretty easy for someone to differentiate between the Chinese people and the Chinese government.&lt;p&gt;Meanwhile, can you prove that this &amp;quot;innate xenophobia&amp;quot; is present in every human to an extent that it&amp;#x27;s actually relevant, and that this particular instance of suggesting that the malware is Chinese in origin meaningfully exacerbates it?&lt;p&gt;Moreover, China is a geopolitical rival to the United States, India, and other countries that constitute a majority of HN readers. Information like this is interesting from that viewpoint.</text></comment>
<story><title>Apt Encounters of the Third Kind</title><url>https://igor-blue.github.io/2021/03/24/apt1.html</url></story><parent_chain><item><author>mwcampbell</author><text>&amp;gt; Chinese APT malware,&lt;p&gt;Why is it necessary to point out the foreign origin? Doesn&amp;#x27;t that just encourage our innate xenophobia?</text></item><item><author>afrcnc</author><text>From Twitter chatter, this appears to be Chinese APT malware, something related to PlugX</text></item><item><author>motohagiography</author><text>Superb work. The &amp;quot;who&amp;quot; of attribution is more likely related to the actual PII they were after than any signature you&amp;#x27;ll get in the code. Seems like a lot of effort and risk of their malware being discovered for PII instead of being an injection point into those users machines. I rarely hear security people talk about  &lt;i&gt;why&lt;/i&gt; a system was targeted, and once you have that, you can know what to look for, inject canaries to test etc.</text></item></parent_chain><comment><author>mc32</author><text>If it were Russian, American or Israeli would you have the same reservations?</text></comment>