Palo Alto Networks Unit 42, which is tracking the activity as Playful Taurus, said it observed the government domains attempting to connect to malware infrastructure previously identified as associated with the adversary.