One C2 kit. 30 customers. 2 governments

A threat intelligence researcher discovered that a blockchain-based C2 kit was shared among roughly 30 operators — including two plausibly state-aligned actors and ~28 criminal groups — all sourced from the same builder. This structural convergence of nation-state and criminal infrastructure undermines traditional SOC triage logic, which routes severity based on presumed actor identity. The post argues that shared tooling is an anti-signal for attribution, not a weak one, and recommends three practical changes: sever severity from attribution, anchor detections on durable technical constants rather than rotating infrastructure, and cap attribution confidence explicitly in reports. Supporting evidence from Mandiant, Microsoft, CISA, and FBI shows Russia, China, Iran, and North Korea all reaching the same destination — rented or stolen criminal infrastructure — via different routes.