To fully exploit a target environment, IRON TWILIGHT used the XAgent (also known as Chopstick) modular remote access trojan (RAT) and the XTunnel persistent backchannel tool. XAgent can jump air-gapped networks by infecting USB storage devices and can be used against Windows and Unix-based operating systems. XAgent variants such as Komplex provide RAT functionality on the Mac OS X operating system, and the threat group maintains variants that operate on Apple iOS and the Google Android mobile operating systems. XTunnel provides IRON TWILIGHT with secure access to a compromised environment though a back connection created by the malware to a command and control (C2) server