The attackers used Python code to first download and execute a script that was created with an open-source tool called fileless-elf-exec.