What is the attack vector here? Malware running in user-space or remote commands from the (compromised) mothership?