Once a victim was accessed, attackers would determine if the user account was an administrator or normal user. They would then download post-exploitation tools that included password/process-dumping utilities, reverse-tunneling tools, and custom backdoors