Hacker News Reader

They mentioned that the suspicious traffic stopped after a restart.

I'm not seeing that mentioned in this blogpost, was it mentioned in one of the other ones?

They talk about it here, under "what we know so far"

FTA: "Once the device rebooted, all the suspicious activity stopped."