Threat attribution and indicator quality

The espionage quartermaster: China-nexus operators were buying scan and relay as a service

Lumen's Black Lotus Labs spent a year mapping a four-part framework sold to Chinese espionage operators. Its indicators belong to a supplier, so hunt the service rather than one group's habits.