Investigators discovered Russian-language comments within the malicious extension code and Russian metadata in a PDF tied to the attacker's server.