"They also used a couple of zero days, so we know they are funded pretty well," said Thakur. "In the underground, you have to spend a lot of money to get access to the zero days -- or have a lot of technical know-how to do it yourself."
There is another possible explanation for how this group works, according to Ron Arden, vice president at security firm Fasoo.
They could be hackers for hire, ready to go to work for anyone motivated enough to hire them, he said.
These kinds of deals are often arranged through intermediaries, he said.
"About a year ago, there was a Korean company that bribed Dupont employees to steal information so they could recreate chemical products," he said.
Criminals looking for stock market tips are more likely to be going after financial documents or five-year plans, he said.
"If they're stealing formulas for pharmaceuticals or manufacturing designs, it's more likely that they're trying to sell it to someone who, say, might want to make knock-offs."
Sign up for CIO Asia eNewsletters.