I find this info is interesting

> The attackers went through a qualification process and multiple rounds of emails with potential victims, making sure they were high-payoff targets before they directed victims to the page containing the exploit payload.

It's a well-prepared plan combining social engineering and technical exploits