2. <conjecture> Kaspersky ? </conjecture> + ISPs, universities, etc.
It must be an interesting life for the French admin of the "real" devlan.net since the leaks.
2. I don't get the Kaspersky reference. Can you explain?
ISP and University: I suppose you mean those would be running public Solaris hosts, right? And that therefore the CIA has been hiding on those servers. I sure would hate the CIA to spy on scientists, though it's not unheard of that one of the agencies knocks on a door of a scientist who just happened to be on the verge of publishing something they deem a risk. Happened in the past and sure still does. The imbalance and abuse of power is the problem and here it's legalized/constitutionalised. An agency can spy on my private life and professional work without being questioned, but we aren't allowed to demand a transparent administration or any of the many ranches of government.
I have many questions but two are very high on my list:
1. one of the commit messages mentions merge from a git remote hosted at devlan.net. Who owns that host and is it a hidden CIA server or repurposed captured host?
https://wikileaks.org/vault8/document/hive-log/page-41/#pagi... Merge branch 'master' of ssh://stash.devlan.net:7999/hive/hive
https://www.whois.com/whois/devlan.net
It kinda looks like a captured host registered originally by a French admin.
2. Why Solaris? Microtik and the other router targets make sense in combination with generic Linux machines, but Solaris sticks out and there must be an interesting explanation for targeting that. What kind of internet facing Solaris hosts are out there or which orgs use it in such a capacity to become a target for the CIA?