I believe they were trying to use it as a means to infect devices that they may actually use at work as well on govt systems to get to the good stuff, or were phishing credentials in hopes they reuse their passwords somewhere at work (govt. systems). I don't think they were actually monitoring their posts and feeds on Facebook as much to obtain inside information.