TrendLabs: Campaign Possibly Connected to “MuddyWater” Surfaces in the Middle East and Central Asia

Figure 12. When the threat actor discovers the researcher via an improper request

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/