The botnet’s campaign has evolved through three distinct phases, testing new infection routines and defense evasion techniques before potentially launching a broader attack.