It has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. It has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).