Sergey Lozhkin, principal security researcher at Kaspersky’s Global Research and Analysis Team, says Kaspersky software initially detected something malicious in the WININIT.EXE process on customer computers, which was triggered by code sequences they had earlier seen in malware used by the NSA’s Equation Group hackers. It appeared in an early version of the malware and has left the researchers baffled about who is behind the platform — nation-state actors conducting spy operations and using the cryptocurrency miner and ransomware as a cover to hide their espionage; nation-state actors moonlighting as ransomware operators to earn money on the side; cybercriminals hacking for profit and also doing espionage-for-hire operations?