The attackers don’t seem to be state-backed, though. They’ve also attacked government officials at “several” revenue authorities, and Check Point noted that there have been similar campaigns that targeted Russian speakers. At least one of the culprits, nicknamed EvaPiks, has been linked to a hacking forum where card theft was a subject of discussion. The intruders may be “financially motivated” based on this evidence, Check Point said.

As it is, the group is occasionally sloppy. While it planned the campaign and created false documents specific to each target, some parts of the campaign have left the attacker’s personal info exposed. If this is a state attack, it wasn’t a particularly good one. Not that this is much comfort to victims — they’ve had potentially sensitive data exposed to crooks who intend to abuse it.