What's more likely:

* CIA malware is discovered by a (Russian) Security company and they release a report about it.

* CIA malware discovered a year or more ago by a (Russian) security company and they tell the CIA about it and the CIA asks them to wait 1y+ to release the report, and they obliged.