One item I'd like to add is that this was a very sophisticated threat actor on HOC networks. We found the very early stages. The tracking links are the first stage. The next stage would be a dropper. The next stage would be actual exploitation software, which would have been very serious.
We would like to reinforce that the steps taken between HOC and ourselves prevented a compromise of HOC networks by this sophisticated threat actor.