During the forensic review, engineers discovered that spoofing had been used to modify the application so it appeared to run normally while secretly circumventing security mechanisms.