By leveraging an existing backdoor they are reducing the chances of their own activity being detected. Attempting to introduce a net new backdoor may have led t

By leveraging an existing backdoor they are reducing the chances of their own activity being detected. Attempting to introduce a net new backdoor may have led to them generating additional indicators of compromise and risked being detected sooner.