PlugX — A remote access tool notable for communications that may contain HTTP headers starting with "X-" (e.g. X-Session: 0"). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. DLL side loading has been used to maintain persistence on the compromised system. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. The server-side component provides a simple graphical user interface for threat actors interacting with web shells. ChinaChopper web shell. shown in Figure 4, are required to interact with the web shell. TG-3390 has used additional web shells containing similarly formatted passwords