Visitors to sites exploited by Emissary Panda are directed by code embedded in the sites to a malicious webpage, which screens their IP address. If the address falls within ranges that the attackers are interested in, the malicious site waits for their next page view to drop an exploit on the desirable target's PC. There has also been at least one victim targeted by a spear-phishing attack. A variety of malware, including the PlugX tool, was shared with other known Chinese threat groups