Geppei and Danfuan add to Cranefly’s custom cyber weaponry, with the former acting as a dropper by reading commands from IIS logs that masquerade as harmless web access requests sent to a compromised server.