Comment by polysics

The MITM on HTTPS traffic that seems to be involved in the first attack stages is actually pretty good evidence.