with it, both the apple-iclouds[.]net and itunes-helper[.]net domains have direct ties to Sofacy activity. The appleiclouds[.]net domain is mentioned within a PwC Tactical Intelligence Bulletin that discussed a phishing campaign