Google's Threat Analysis Group uncovers an ongoing campaign