That's right, for normal antiviruses, you first need to study a malicious program and only then develop a tool to detect and combat this. Romada works differently, as I understand it.
I understand that although there are new viruses, they still belong to the old, known groups. And once the groups are known, then the antivirus program of this team will immediately identify and destroy them.