The malware establishes initial access on targeted machines, then waits for additional code to execute.
Threatpost

Read More