Proofpoint said this variant is attributed to the threat actor TA2725