As an open-source tool, it has been used by several state-backed espionage actors like the Iranian APT33 and APT35 groups, as those tools make attribution and persistent operation harder to track.

It does not crash systems or raise alarms. It blends into everyday Windows activity and works quietly in the background. By the time it is noticed, control may already be lost.Security teams are ...