Mitm a website and inject browser exploits? Scanning IP addresses they see downloading? A news article leaving out the vital parts is nothing new though m

Maybe they were just targeting with no actual action. Like they had their sights set on their cardboard tank.

Skimming the article, it appears they attacked a particular client that is popular in Korea.

They infected peoples computers with malware