These attackers are after the IT blueprints of other organizations. So that they can build a hibernating bot inventory. They can then sell pwned corporate computers to 3rd parties for BTC. Phishing and Spear Phishing doesn't work well on pro users. But this does.