Hacker News Reader

It wasn't clear to me from reading the blogpost that persistence _wasn't_ achieved?

They mentioned that the suspicious traffic stopped after a restart.

I'm not seeing that mentioned in this blogpost, was it mentioned in one of the other ones?

They talk about it here, under "what we know so far"

FTA: "Once the device rebooted, all the suspicious activity stopped."