The backdoor supports the following commands:  $upload - upload a file to file hosting service $dispos - remove persistence $halt - exit $download - download file from a hosting service No prefix - execute command via Invoke Expression (IEX), a PowerShell command that runs commands or expressions on the local computer  Based on our analysis, we can confirm that the targets were Turkish government organizations related to the finance and energy sectors.