"AfterMidnight" lets operators to dynamically load and execute malware payloads with a target device. The primary controller disguises for a self-persisting Windows Support DLL and supplies safe execution of "Gremlins" by means of a HTTPS dependent Listening Article (LP) procedure called "Octopus". Once installed on a target equipment AM will call