While the code quality of its payloads is not of the highest standard, this threat actor uses innovative techniques when crafting its malicious documents, such as  hiding malicious code in the comments section, or using encrypted documents to prevent automatic analysis.