It researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. It has also researched third-party websites to help it craft credible spearphishing emails.