Each time a victim’s environment removes their access, the group wastes no time re-compromising the environment with a variety of mechanisms, immediately restarting their data theft campaign.