At the same time, the group even goes as far as deploy its own complete Java web application on victim machines to do its bidding while these machines also run legitimate applications.