Information on how the attack started or where it originated was not available, but Guerrero-Saade said that once inside a network, the attackers used group policies to deploy their malware, delete shadow volume copies to prevent data recovery, and disconnect infected hosts from their local domain controller, to pre- vent Sysadmin from quickly remediating infected systems.