The adult game first used by the attackers was also found in the list of games advertised by hxxp://www[.]roundyearfun[.]org Our analysis revealed that hxxp://www[.]roundyearfun[.]org was also used as a C&C address to save victims’ data.