While investigating Operation DRBControl in 2019, we found several connections to multiple threat actors:  Iron Tiger, which uses the HyperBro trojan and some infrastructure links Winnti, which uses the same infrastructure and code-sharing links detailed in our paper Bronze President, a threat actor that targets non-governmental organizations (NGOs).  