By performing two-factor authentication interception by receiving the OTP on their own telephone number, they gained access to the company network via the VPN. Our hypothesis is that they tested the 2FA-system first or selected the primary phone number to send a SMS to. Thus the 2FA code was sent with supporting Chinese text