The campaign uses double infection points and two command-and-control servers.

The threat actors behind widespread attacks on banks and ATM jackpotting campaigns in Russia and Europe resurfaced in may, attacking banks.