malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers.  malware RomeoDelta copies specified directories from the victim's machine, then archives and encrypts the directories before uploading to its C2 server.