Help From Law Enforcement

• Harry was able to get some FBI agents to talk to him for a couple hours
• Binaries given to FBI, not submitted to AV vendors to avoid tipping them off
• Six days later, we notice the writeup on sarc.com
• The FBI forensics work apparently consisted of submitting the files to Symantec
• Attacks start leveling off a few days after AV vendors issue signatures