The advanced persistent threat group also relied on SOCKS proxies like SoftEther VPN, tunneling tools that act as a middleman between victim and attacker.
China's Webworm Uses Discord, Microsoft Graphs to Hack EU Governments
Summary + source link. No paywalls, no tracking.