 one way they're doing this is a kind of quiet stealth mode. They do it after they've successfully penetrated a corporate network. They stay quiet and only later actually trigger the actual attacks when they know more about the system and after the tracks of their arrival, how they got in, how the penetration was done, may have already been completely deleted.