But we‘re talking about no clear evidence as GIB hasn’t done IR in these cases, just in control of C2 logs. Some law enforcers involved in the case said it was DPRK using payment switch code injection. This would at least fit most to the statement no transactionlogs were found.