[cookiengineer]

> What kind of jerk would attack Arch Linux?

The answer is: Russians

Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely.

Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware.

[1] https://github.com/cookiengineer/antimiasma

[2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...

[inigyou]

This is also very common with malware groups that want you to think they are Russian.

[cookiengineer]

The comment length is too small to write a thorough malware analysis.

That is why I linked my blogposts, the tool, and the whitepaper that I published about it. You have to read it first to come to your own conclusions.

If you come to conclusions without reading either of it, there's no point in arguing with you because you made up your mind anyways, and are not interested in learning about malware reversing :)

[tmtvl]

Only ru_RU? It doesn't get disabled with, say, zh_CN, ko_KR, or anything else where the script is outside of the Basic Multilingual Plane (AKA ASCII)?

[inigyou]

> the Basic Multilingual Plane (AKA ASCII)

Incorrect. ASCII is 0000-007F and the BMP is 0000-FFFF

[tmtvl]

You're right, I'm wrong, my bad. Still I wonder if the software fails to work when paths contain unexpected characters.