On: XZ backdoor story – Initial analysis

[r721]

>Authors GReAT

>Global Research & Analysis Team, Kaspersky Lab

https://securelist.com/author/great/

The article is apparently authored by malware analysis team from Kaspersky Lab, so they are probably quite good at reverse engineering binaries.

[usr1106 → r721]

Sure. But that does not answer any questions about their tooling or methods. Considered a business secret? They present the readable C code of the binary payload like it has appeared just out of the blue.

[saagarjha → usr1106]

They're using IDA Pro, with names that they presumably came up with themselves by analyzing what the code does.