Mitm a website and inject browser exploits? Scanning IP addresses they see downloading? A news article leaving out the vital parts is nothing new though m
Maybe they were just targeting with no actual action. Like they had their sights set on their cardboard tank.