Used to gain initial code execution on vulnerable systems - **DoublePulsar backdoor installer** — A secondary NSA tool used to inject the payload into the target's memory - **Ransomware payload** — Encrypted user files with AES-128 and RSA-2048, demanding $300-600 in Bitcoin for decryption - **Worm