Nov 12, 2017

This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description on page 2 (I found the increasing level of separation between collector and reciever to be almost comical)

[1] https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu...

[2] https://news.ycombinator.com/item?id=15663985

Nov 09, 2017

Kaspersky has a response to the attacks on attribution that's quite relevant to this story which you can read here:

https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu...

It was on HN before, but it vanished quickly -

https://news.ycombinator.com/item?id=15483529