The campaign started with a trojanized version of unsupported financial software