The reported campaign shows how a long-running espionage cluster can make attribution harder by repurposing third-party infrastructure instead of relying on its own.