One threat actor appears to be behind several ongoing, related campaigns.
Source: Threadpost