Well, I hope someone tells them their backdoor has been compromised.

This is exactly what it's used for.

Indeed, in years of writing PHP I only know of C99 because I found endless copies of it squirreled away, obfuscated, appended to other files, base64 encoded, and/or masquerading as jpg files after one of our servers was compromised.