Nefilim operators use the MEGAsync application to exfiltrate data to cloud storage. MEGAsync application synchronizes folders between the infected computer and an adversary-controlled MEGA Cloud Drive.