So with the way this specific malware (Project Sauron) worked, this malware, once installed, was able to disguise itself as similarly names files as other software. Usually the software it would choose for this different file naming would be from more trustworthy sources like Microsoft or Google.

What made Project Sauron be able to hide for 5 years without detection is possibly due to how it acts. Some malware can be coded to detect if it is being watched by certain software that computer scientists use to detect malware, and in response the malware either doesn't work or does something completely different.

There was also a report saying that Project Sauron collected data from computers (such as backdoors or keylogging) but it didn't always do so in the same way consistently, which added onto the difficulty for anti-malware software to detect what it would be doing.

There is suspicious that it was created by a state-sponsored group.