Yes they do according to Avast Anti-Virus maker using evidence from Wikileaks. They evaluated lots of different anti-virals to see which ones they could exploit and they created their own malware threats to test vulnerabilities.
Many consider it highly unethical to release malware into the general public (“into the wild”) but I guess they feel they can do what they want.
Here is the article from Avast
I’ve been building WordPress sites for 10 years. I recently switched from building the super powerful and complex self-hosted WordPress.org type sites to simpler and much more bullet-proof WordPress.com sites. This site, MalMilligan.com, is now running on WordPress.com for example.
In 10 years, WordPress has taken over 28% of cyberspace. Which is an incredible feat considering all the competition and all the big bucks huge companies have thrown into web platforms.
Envato Article on WordPress taking 28% of the Internet