Five of the Leader personas claim to be recruitment consultants, which would provide a pretext for contacting targets. TG2889 likely uses spearphishing or malicious websites to compromise victims, and established trust relationships significantly