"AfterMidnight" allows operators to dynamically load and execute malware payloads on the goal equipment. The key controller disguises as a self-persisting Home windows Services DLL and offers secure execution of "Gremlins" by way of a HTTPS based Listening Article (LP) procedure termed "Octopus". On