>Not well respected
Did you criticize Crowdstike before the 2016 election? Because they're very highly regarded.
>You are taking crowdstrike at their word.
You don't have to trust Crowdstrike, as there are other organizations that did analysis. Most of my links were not from Crowdstrike.
The analyses do not rely solely on C&C IPs, and the fact that you keep harking on that makes me think you haven't read those links. There's lots of TTP and malware analysis.
>that's their defense for not handing over the servers/drives.
It is extremely common for groups to share imaged versions of a computer.
