The spy malware is being delivered via a complex infrastructure with multiple layers, in an effort to avoid analysis.
Source: Threadpost