Researchers assess the activity as China-nexus with medium confidence, citing victim selection, shared malware tooling, ...