The malicious actors attempted to target cryptocurrency services and users, zeroing in on services like Ledger, Trezoe, Jaxx, Electrum, MyEtherWallet, MetaMask, Exodus, and KeyKeep, specifically. Some of these lured further victims by boasting fake five-star reviews. It is believed the malicious code may be linked to an individual or group in Russia.