Procedure examples

ShadowPad has used UDP for C2 communications.

QakBot has the ability use TCP to send or receive C2 packets.

Gelsemium has the ability to use TCP and UDP in C2 communications.

PHOREAL communicates via ICMP for C2.

Lizar has used a raw TCP connection to communicate with the C2 server.

HiddenWasp communicates with a simple network protocol over TCP.

WarzoneRAT can communicate with its C2 server via TCP over port 5200.

FRP can communicate over TCP, TCP stream multiplexing, KERN Communications Protocol (KCP), QUIC, and UDP.

Brute Ratel C4 has the ability to use TCP for external C2.

Mythic supports WebSocket and TCP-based C2 profiles.

QuasarRAT can use TCP for C2 communication.

Calisto adds permissions and remote logins to all users.

Shai-Hulud has modified GitHub account settings for private repositories and changed them to public.

The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.

Pacu can generate SSH and API keys for AWS infrastructure and additional API keys for other IAM users.

Skidmap has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.

Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.

XCSSET will create an ssh key if necessary with the ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P command. XCSSET will upload a private key file to the server to remotely access the host without a password.

AADInternals can register a device to Azure AD.

DarkGate elevates accounts created through the malware to the local administration group during execution.

SMOKEDHAM has added user accounts to local Admin groups.

ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.

The `net localgroup` and `net group` commands in Net can be used to add existing users to local and domain groups.

Bumblebee has been downloaded to victim's machines from OneDrive.

BRICKSTORM has leveraged DNS web services to resolve C2 IP addresses including sslip.io and nip.io. BRICKSTORM has also utilized Cloudflare Workers for C2 communications.

SharpStage has used a legitimate web service for evading detection.

NETWIRE has used web services including Paste.ee to host payloads.

BADHATCH can be utilized to abuse `sslip.io`, a free IP to domain mapping service, as part of actor-controlled C2 channels.

DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.

ShrinkLocker uses a subdomain on the legitimate Cloudflare resource "trycloudflare[.]com" to obfuscate the threat actor's actual address and to tunnel information sent from victim systems.

Hildegard has downloaded scripts from GitHub.

Snip3 can download additional payloads from web services including Pastebin and top4top.

GuLoader has the ability to download malware from Google Drive.

WhisperGate can download additional payloads hosted on a Discord channel.

Raspberry Robin second stage payloads can be hosted as RAR files, containing a malicious EXE and DLL, on Discord servers.

Doki has used the dogechain.info API to generate a C2 address.

Nightdoor can utilize Microsoft OneDrive or Google Drive for command and control purposes.

CHIMNEYSWEEP has the ability to use use Telegram channels to return a list of commands to be executed, to download additional payloads, or to create a reverse shell.

SocGholish has used Amazon Web Services to host second-stage servers.

DarkTortilla can retrieve its primary payload from public sites such as Pastebin and Textbin.

PureCrypter can use Telegram or Discord to send infection status messages.

Latrodectus has used Google Firebase to download malicious installation scripts.

CharmPower can download additional modules from actor-controlled Amazon S3 buckets.

SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.

RedLine Stealer has leveraged legitimate file sharing web services to host malicious payloads.

Sibot has used a legitimate compromised website to download DLLs to the victim's machine.

Bazar downloads have been hosted on Google Docs.

Carbon can use Pastebin to receive C2 commands.

AshTag can download malicious payloads from file sharing services.

MOPSLED can use third-party web services such as GitHub and Google Drive for C2.