Procedure examples

During Cutting Edge, threat actors used the Unix socket and a reverse TCP shell for C2 communications.

During C0021, the threat actors used TCP for some C2 communications.

Versa Director Zero Day Exploitation used a non-standard TCP session to initialize communication prior to establishing HTTPS command and control.

During Operation Wocao, threat actors used a custom protocol for command and control.

During the 2022 Ukraine Electric Power Attack, Sandworm Team proxied C2 communications within a TLS-based tunnel.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network.

During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.

During C0027, Scattered Spider used aws_consoler to create temporary federated credentials for fake users in order to obfuscate which AWS credential is compromised and enable pivoting from the AWS CLI to console sessions without MFA.

During HomeLand Justice, threat actors added the `ApplicationImpersonation` management role to accounts under their control to impersonate users and take ownership of targeted mailboxes.

During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.

During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.

During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges.

During Operation Digital Eye, threat actors used SSH access enabled by authorized_keys files for remote execution.

During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.

During C0027, Scattered Spider registered devices for MFA to maintain persistence through victims' VPN.

During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.

APT41 DUST used compromised Google Workspace accounts for command and control.

During C0017, APT41 used the Cloudflare services for C2 communications.

During C0027, Scattered Spider downloaded tools from sites including file.io, GitHub, and paste.ee.

During the 3CX Supply Chain Attack, AppleJeus leveraged a GitHub repository to host icon files containing the command and control URL.

During C0017, APT41 used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably APT41 updated the community forum posts frequently with new dead drop resolvers during the campaign.

For Operation Ghost, APT29 used social media platforms to hide communications to C2 servers.

During the 2025 Poland Wiper Attacks, the adversaries had communicated to both Dropbox and Pastebin.

ArcaneDoor utilized HTTP command and control traffic where commands are intercepted from HTTP traffic to the device, parsed for appropriate identifiers and commands, and then executed.

During RedPenguin, UNC3886 used malware with separate channels to request and carry out tasks from C2.

During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.

KV Botnet Activity included the use of scripts to download additional payloads when compromising network nodes.

During SharePoint ToolShell Exploitation, threat actors used a loader to download and execute ransomware.

During Frankenstein, the threat actors downloaded files and tools onto a victim machine.

During RedPenguin, UNC3886 used backdoor malware capable of downloading files to compromised infrastructure.

During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.

During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.

During Operation MidnightEclipse, threat actors downloaded additional payloads on compromised devices.

During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.

During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.

Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.

During ShadowRay, threat actors downloaded and executed the XMRig miner on targeted hosts.

During C0021, the threat actors downloaded additional tools and files onto victim machines.

During C0015, the threat actors downloaded additional tools and files onto a compromised network.

During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.

During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.

During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.

During Outer Space, OilRig downloaded additional tools to comrpomised infrastructure.

During the 2025 Poland Wiper Attacks, the adversaries downloaded malicious payloads to the victim server.

During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.

APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.

During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.

During Operation Wocao, threat actors downloaded additional files to the infected system.

During C0017, APT41 downloaded malicious payloads onto compromised systems.