The attack is part of a trend where threat groups hide malicious activity by communicating with legitimate web services such as social networking and cloud storage sites to foil detection efforts.[2][3] A Cyber Campaign Likely Intended to Monitor Hong Kong Media During a Period of Crisis The threat group has previously used newsworthy events as lures to deliver malware.[4] They have largely targeted organizations involved in financial, economic and trade policy, typically using publicly available RATs such as Poison Ivy, as well some non-public backdoors.[5] The group started targeting Hong Kong media companies, probably in response to political and economic challenges in Hong Kong and China