[azinman2]

The CIA's dos and donts specifically mention putting build timestamps into others time zones: https://www.schneier.com/blog/archives/2017/03/the_cias_deve...

[INTPenis]

Yes but domains are registered and C&C servers are activated, things that can be tracked on other ends like clients and public databases.

So what they really need to do is make a queue system for actions like that and have them execute randomly during weekends. Would require a lot more patience and long sightedness but I don't see any other way of masking it.