"AfterMidnight" enables operators to dynamically load and execute malware payloads over a target device. The primary controller disguises for a self-persisting Windows Assistance DLL and supplies protected execution of "Gremlins" by means of a HTTPS based Listening Post (LP) program named "Octopus".