Use the multi-agency official AA23-270A advisory. Verify aliases and targeting, the trusted-branch pivot, custom malware examples, firmware replacement sequence, EEM concealment, trigger-packet fields, and backdoor logging behavior.