[saagarjha]

They mentioned that the suspicious traffic stopped after a restart.

[munchinator]

I'm not seeing that mentioned in this blogpost, was it mentioned in one of the other ones?

[qup]

https://securelist.com/operation-triangulation/109842/

They talk about it here, under "what we know so far"

[teachrdan]

FTA: "Once the device rebooted, all the suspicious activity stopped."