It has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. It also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.