The threat group likely used tools like Cobalt Strike as well as ShadowPad, a modular RAT that is a successor to the PlugX malware, in its attack.