It has deployed different types of containers into victim environments to facilitate execution. It has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.