It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.