In fact, majority of their campaign codes
included number combinations which represented the
month and date in MMDD format when the attack attempt
was executed. The rest of the campaign code string
often describes the decoy document that was used in a
specific campaign. For instance, a campaign code from
October 2011 is “army-1022” where attackers used a decoy
document containing military-related information