[dahdum]

Malware will pull updates and commands from the internet, if they didn’t allow network access it would be near useless of a service. Attackers can make the binary pre-update look as innocent as they want.