The Tom’s Hardware article makes it sound like the attackers were using IoT botnets which I’m guessing were using known domains to coordinate.

https://www.tomshardware.com/tech-industry/cyber-security/us-justice-department-claims-chinese-state-sponsored-hackers-infiltrated-systems-at-nasa-senate-federal-reserve-and-more-fbi-moves-forward-with-domain-seizures

The US is claiming they “denied access” to China via domain seizures? What?

The user is likely not the target of the spying. The white house is likely spying on other branches and agemcies within the government.

A lot of government jobs provide you with a phone that is provisioned for closed government networks.

The White House spp is likely being used to spy on those networks.