It executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. It has used malicious macros embedded inside Office documents to execute files.