From the article:

> One of the useful features of this multiscanner is that they allow searching for similar malware to get some context, and in doing so, we stumbled across a couple of files that were very different.

>We noticed that the other files were all uploaded by a similar uploader.

It appears they then automated downloading samples and scanned for content.

From what I can tell, the files were discoverable by anyone that was able to access/search this multiscanner service.

For instance, malwr.com allows the downloading of samples by authenticated users. VirusTotal also allows researchers access to download submissions via their private API[0].

[0] https://www.virustotal.com/en/documentation/private-api/#fil...