Cybercriminals stay under the radar for extended periods of time to execute malware such as banking Trojans, forcing organizations to reassess their security tools, according to a report from Damballa.

In its "State of Infections Report," the Atlanta-based network security monitoring firm highlighted how criminals spread malware called Pony Loader, which has been around for years. It has remained undetected thanks to a structured routine that includes consistently creating new domains and establishing new infrastructure, thus ensuring it won't be detected by most security products.

In addition to moving infrastructure, the criminals behind Pony Loader also change the malware itself. In May 2015, the Pony configuration unleashed Dyre, a banking Trojan. In September, it downloaded Vawtrak, another banking Trojan. And on Dec. 2, Nymaim, a form of ransomware, replaced Vawtrak before switching back to its original Vawtrak form on Dec. 14.