It has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. It has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.