The researchers put the tools they used and decompiled code on-line: https://github.com/takeshixx/redstar-tools

Not technical, but I thought it was interesting that it tags files with a record of every computer they have been on, even if it was not accessed. Or that privileged access is only really available to the government, and the operating system guards against many kinds of customizations that we think of as legitimate user actions.