As far as SPEAR could tell, all scripts were designed to be executed using Python v2.7. The group relied heavily on TLS-encrypted FTP using Python’s native ftplib library to transfer data out of target environments. The samples would also test connectivity to the C2 via HTTP requests using Python’s urllib library