The campaign codes and decoy documents used by the
HeartBeat attackers provided valuable insights on their
campaigns. In fact, majority of their campaign codes
included number combinations which represented the
month and date in MMDD format when the attack attempt
was executed. The rest of the campaign code string
often describes the decoy document that was used in a
specific campaign.