deliver the malware. It is likely that the threat was delivered through spear-phishing emails, since a wateringhole attack was never seen or reported in the breach. The malware itself was disguised using Citrix and Juniper