I also thought it was odd he always seemed to have no problem catching US nation state malware, but all of those Russian state cyber weapons other companies keep finding seem to allude him and his team.
Coincidence?
Kaspersky blog has written up analyses of malware campaigns from many different countries. Here are some Russian-origin APT campaigns.
1. https://blog.kaspersky.com/turla-apt-exploiting-satellites/9...
2. https://securelist.com/blog/research/69731/the-cozyduke-apt/
3. http://www.kaspersky.com/about/news/virus/2014/crouching-yet...
Brian Krebs also writes about popular malware that first does a check to see if its being run on a computer in Russia. If so, it stops running. There's a lot of government sponsored malware coming from Russia. There's a public private partnership to put profitable malware on non-Russian computers and Russian officials turn a blind eye due to corruption, bribes, etc. Its all fairly ugly.
On a cyber weapons level, who knows, but citing things like TTP which releases to FOSS or Israel's defense industry as a sign of corruption is asinine and not remotely comparable to what is the status quo in Russia. Cyber weapons will always be here and, when used correctly, can't be detected by signature based AV because they have no idea what to look for and the exploits they use are typically zero days. Stuxnet used, I believe, 3 or 4 different zero day attacks.
Nor did you bother to read the Kaspersky articles where the proof is laid out in a pretty obvious way. I think its foolish to knee-jerk to "Oh Russia does this, so must everyone else." Certainly there are degrees of corruption, and Russia is on the extreme end of this scale. Brian Krebs and Tavis Ormandy aren't on some NSA payroll to make Russia look bad. Russians do that for free. Lets stop playing the "every government is the same" card. Its been historically untrue.
>Every security vendor is aligned with it's "host" nation
Also, I really doubt the guys writing rules for Snort, ClamAV, or mod_security or OSSEC are aligned with anyone. Your view is incredibly cynical and very much an example of the disingenious tactic of "whataboutism" Russians use to defend their wrongdoings. Those rules are public, pray tell, which ones are NSA backdoors? I suggest you come up with some proof if you're making such accusations. The articles I linked to about Kasperky are significant and well-researched.
edit: I cant reply below so I'll type it here. Clinton-era crypto limitations are a non-issue. Clinton lost the crypto wars after the Clipper chip was never passed or funded and after Phil Zimmerman wrote PGP and helped end crypto restrictions. I'm talking about things happening right now. 20+ years ago whining is not helping nor relevant. Use whatever crypto you like.
Symantec did a very extensive study on Stuxnet they were the ones that confirmed that it was intended to damage the centrifuges by fooling the industrial motor controllers.
What is more likely is that a national intelligence organization will use the local security vendors for counter intelligence purposes i.e. tipping them to suspected cyber intelligence operations that they've identified through other means.
This is a much more likely scenario than simply telling them not to talk about certain malware, it's easier to enforce and it provides them with both deniability and a more favorable outcome.
Geopolitics also play an important role here, different vendors have different market share in different regions. Kaspersky for example is more common in lower income countries, as well as countries that are under direct US sanctions like Syria or Iran, or countries to which US companies will have hard time exporting too or developing their market due to past relations.
So when you have a virus that infects many machines in Iran or Syria it's if any of the computers will be running fully licensed and supported commercial anti-virus software it wont be Symantec or McAfee that they'll be running but rather Kaspersky or any other non-US/Western software.