From Wikipedia
The campaign hijacks a dormant .NET scheduled task for covert persistence by blending legitimate proxies to evade detection
