It has inserted malicious macros into existing documents, providing persistence when they are reopened. It has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.