Our investigation also indicated strong links to Chengdu, Sichuan. The attacker used Yahoo! Mail accounts as command and control servers, from which the attacker sent emails containing new malware to the already compromised