encoding stolen data prior to exfiltration to subvert data loss prevention (DLP) controls.

initiating active probes for open ports with the aim of retrieving service version information.

leveraging publicly available sources to gather information on an enterprise or on individuals.

delivering remote access malware packaged as an executable file via social engineering tactics.