The attack is said to be carried out by UNC3886, which a Google-owned cybersecurity firm describes as a "China-nexus espionage group".