BIFROSE, known for evading detection by communicating with its C&C servers via Tor protocol, also has a version targeting UNIX-based operating systems, which are usually used in servers, workstations, and mobile devices. KIVARS has less functionality than BIFROSE, but its modular structure made it easier to maintain. KIVARS enabled attackers to download and execute files, list drives, uninstall malware service, take screenshots, activate/deactivate keylogger, show/hide active windows, and trigger mouse clicks and keyboard inputs. A 64-bit version of KIVARS also emerged to keep pace with the popularity of 64-bit systems. XBOW’s capabilities are derived from BIFROSE and KIVARS; Shrouded Crossbow gets its name from its unique mutex format