Additionally, once infected, the malware cycles through a large list of command and control (C&amp;C) servers embedded within the malware. It appears while the list is extensive, not all of the C&amp;Cs are active and continue to beacon until a successful connection is established. Despite modifying a small part of itself while copying itself across the network as a means to evade detection, the operators have made no effort to change the C&amp;C communication protocol since its first inception