Attribution is hard. And there is a difference between getting a contractor on the record attributing the toolkit and a bunch of infosec dudes sitting around pontificating about how "everyone knows."

https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/

The mystery of a globetrotting iPhone-hacking toolkit

Tools used in a series of hacking campaigns by hackers in Russia, Ukraine, and China may have originated inside U.S. government contractor L3Harris, TechCrunch has learned.

TechCrunch
@evacide maybe theyre just singing along to the leonard cohen song
@evacide "everyone knows" is so accurate

@evacide I disconnected from the (infosec) news, and am just now catching up.

*sigh*