A group of targeted attacks takes a different spin on methods first seen in PlugX APT operations.