They renamed their files to make them look like legitimate files, for example, KB77846376.exe, named after Microsoft update files. They routinely used standard tools that would mimic legitimate administrator activities. When planting webshells on the Outlook Exchange servers, they modified already existing legitimate flogon.js and logoff.aspx files. They relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution. They used multiple staging folders and opted to use directories that were used infrequently by legitimate users or processes. They routinely deleted dropped attack tools, execution logs, files staged for exfiltration, and other files after they were finished with them. They renamed their tools' filenames in the staging folder so that it would not be possible to identify the malware's purpose, even after it was deleted from the disk through the residual artifacts (e.g. ShimCache entries or WMI Recently Used Apps). - They used timestomping to modify the $STANDARD_INFORMATION attribute of the attack tools