Procedure examples

Mythic supports domain fronting via custom request headers.

Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.

Ursnif has copied itself to and infected removable drives for propagation.

Crimson can spread across systems by infecting removable media.

Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.

Raspberry Robin has historically used infected USB media to spread to new victims.

Conficker variants used the Windows AUTORUN feature to spread through USB propagation.

PlugX has copied itself to infected removable drives for propagation to other victim devices.

DustySky searches for removable media and duplicates itself onto it.

USBferry can copy its installer to attached USB storage devices.

Unknown Logger is capable of spreading to USB devices.

USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.

Ramsay can spread itself by infecting other portable executable files on removable drives.

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.

njRAT can be configured to spread via removable drives.

HIUPAN has periodically checked for removable and hot-plugged drives connected to the infected machine, should one be found HIUPAN will propagate to the removeable drives by copying itself and accompanying malware components to a directory to the new drive in a hidden subdirectory `<Drive_Letter>:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\` and hides any other existing files to ensure UsbConfig.exe is the only visible file on the device.

ANDROMEDA has been spread via infected USB keys.

QakBot has the ability to use removable drives to spread through compromised networks.

H1N1 has functionality to copy itself to removable media.

Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.

USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.

cd00r can monitor incoming C2 communications sent over TCP to the compromised host.

Ninja can forward TCP packets between the C2 and a remote host.

RCSession has the ability to use TCP and UDP in C2 communications.

RotaJakiro uses a custom binary protocol using a type, length, value format over TCP.

COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.

Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.

Misdat network traffic communicates over a raw socket.

reGeorg can tunnel TCP sessions into targeted networks.

BUBBLEWRAP can communicate using SOCKS.

LITTLELAMB.WOOLTEA can function as a stand-alone backdoor communicating over the `/tmp/clientsDownload.sock` socket.

InvisibleFerret has established a connection with the C2 server over TCP traffic. InvisibleFerret has also created a TCP reverse shell communicating via a socket connection over ports 1245, 80, 2245, 3001, and 5000.

Nebulae can use TCP in C2 communications.

TONESHELL has utilized TCP-based reverse shells.

RainyDay can use TCP in C2 communications.

NETWIRE can use TCP in C2 communications.

J-magic can monitor incoming C2 communications sent over TCP to the compromised host.

Aria-body has used TCP in C2 communications.

Crimson uses a custom TCP protocol for C2.

SystemBC has used raw TCP on non-standard ports, such as 4044, for C2 communications and for HTTP communications, which include downloading binaries.

PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.

Mafalda can use raw TCP for C2.

Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.

AuTo Stealer can use TCP to communicate with command and control servers.

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.

SUGARUSH has used TCP for C2.

Cuckoo Stealer can use sockets for communications to its C2 server.

InvisiMole has used TCP to download additional modules.