Leaked document trove shows a Chinese hacking scheme focused