Both malicious programs share the code for LZMA compression algorithm. In CloudAtlas it is used to compress the logs and to decompress the decrypted payload from the C&amp;C servers, while in Red October the “scheduler” plugin uses it to decompress executable payloads from the C&amp;C