In June 2013, the attackers shifted their focus to watering hole attacks. They compromised a number of energyrelated websites and injected an iframe into each of them. This iframe then redirected visitors to another