It has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). It also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.