The threat actor mainly used Potato (BadPotato, JuicyPotato, SweetPotato, RottenPotato, EFSPotato) and PoC (CVE-2018-8639, CVE-20191458), which has been published on GitHub, for privilege escalation. After privilege escalation, they characteristically add the following