tokens: To distribute the malicious excel file, the attackers registered a domain which impersonated the identity of most influential Indian think tank IDSA Institute for Defence Studies and Analyses and used the email id from the impersonating domain to send out the spear-phishing emails to the victims.