It's unclear to me why you believe this is relevant here. This attack indeed uses different tooling, and a completely different attack vector (social engineering via the presentation of a malicious executable in the GUI, as opposed to an auto-run exploit).