The rogue software was observed to open TCP ports 69 and 420 to the public internet. After establishing a connection on one of these ports, the routers responded with the ASCII text "nice" and closed the connection.
Researchers were unable to find any evidence of malicious behavior, one team going so far as to affectionately dub this latest type of infection "radware."