The remote access trojan was being used by a Chinese collective operating since 2014.

The malware-laced files include draft versions of diplomatic statements, correspondence letters, internal administrative notes and other documents.