[_8j50]

So you notify the victims so they can do something about it. I mean you yourself just said how sophisticated the threat was, shouldn't they know an implant accessed sensitive data and may have tampered with the integrity if data as well? Cutting off access is just containment, not eradication. Any operator worth his salt would have multiple ways back in for when the primary implant is burned. A proper incident response involves the consent and participation if the victim,the implant/malware is not the problem, what was and might be done using it is.