The result is impressive.

The company has linked six different families of malware—“implants,” as the NSA calls them—to the Equation Group, the oldest of which has been kicking around since 2001. The malware has stayed below the radar in part because the NSA deploys it in limited, cautious stages. In the first stage, the agency might compromise a web forum or an ad network and use it to serve a simple “validator” backdoor to potential targets. That validator checks every newly infected computer to see if it’s of interest to the NSA. If not, it quietly removes itself, and nobody is the wiser.