Seems like a massive opsec hole. Why not force all outbound connections through an offshore VPN or proxy at their internet gateway.

It's odd on a site like HN that ideas like this occur to hardly anyone. Well, on certain subject matter of course.

Lets see what Jonathan Haidt has to say on the matter:

https://www.youtube.com/watch?v=v6nNT0JtHT8

Something like this?

"“With UMBRAGE and related projects the CIA cannot only increase its total number of attack types, but also misdirect attribution by leaving behind the ‘fingerprints’ of the groups that the attack techniques were stolen from,” Wikileaks said in a statement."

https://www.usatoday.com/story/news/2017/03/07/wikileaks-cia...

and for remote control:

"In April this year, WikiLeaks disclosed a brief information about Project Hive, revealing that the project is an advanced command-and-control server (malware control system) that communicates with malware to send commands to execute specific tasks on the targets and receive exfiltrated information from the target machines. Hive is a multi-user all-in-one system that can be used by multiple CIA operators to remotely control multiple malware implants used in different operations."

https://thehackernews.com/2017/11/cia-hive-malware-code.html

No, nothing like a project to re-use commodity code, or a C&C server platform.

How would either be relevant?