This threat actor targets and compromises entities in the defense, construction, technology, and transportation sectors. Up until 2015, it was primarily focused on U.S. and UK entities, but it shifted to Hong Kong–based targets afterward. The U.S. Department of Justice indicted three members of this threat actor group in November 2017 for compromising the networks of three U.S. companies.