MCMD provides the threat actor with a reverse command shell, which facilitates the execution of arbitrary commands on the impacted device, as well as the ability to upload and download additional files. In all observed cases, MCMD utilizes PHP pages on compromised websites for command and control (C2) capability