value:  The ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed. 
name: Impair Defenses: Disable Or Modify System Firewall