The attacker used a polymorphic malware builder to generate malware with a unique hash for each victim, preventing signature-based solutions from detecting the new attacks before it was too late for the victim.