These are presumably threat actors choosing an infiltration route on purpose. At least, that's how I understand the logic behind it.