I think the main reason it was running under the radar is that the script itself did not contain an exploit that bypassed any security mechanisms. The only diff

I think the main reason it was running under the radar is that the script itself did not contain an exploit that bypassed any security mechanisms. The only difference between a remote desktop app and a new command and control malware is the way it is installed. It is not all that surprising to me that any targeted malware could operate unnoticed for years. The odds of discovery are directly proportional to the volume of distribution and inversely proportional to the importance of the targets. This malware apparently infected a small number of low profile targets.