How tight is the "noose of the surveillance state" when it takes them years to stop groups like this? For example, the smokeloader malware mentioned in the post has been around since at least 2011 [1]

[1] https://attack.mitre.org/software/S0226/