The threat actor is deploying multiple connections into victim environments to maintain persistence and steal data.