Procedure examples

BoomBox can download files from Dropbox using a hardcoded access token.

ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.

Brute Ratel C4 can use legitimate websites for external C2 channels including Slack, Discord, and MS Teams.

Kali365 has used Cloudflare Workers to redirect traffic and to host malicious phishing pages. Kali365 has also leveraged Telegram chat to facilitate administrative tasks for the panel across affiliate users.

Tsundere Botnet has obtained the C2 address from Ethereum blockchain nodes.

PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.

TRANSLATEXT has used a dead drop resolver to retrieve configurations and commands from a public blog site.

Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.

Javali can read C2 information from Google Documents and YouTube.

PlugX uses Pastebin to store C2 addresses.

Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.

The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums.

CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.

GlassWorm has leveraged blockchain-based C2 infrastructure to include Solana blockchain that contains additional C2 details within the memo field. GlassWorm has also leveraged Google Calendar to host encoded data.

Metamorfo has used YouTube to store and hide C&C server domains.

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.

Grandoreiro can obtain C2 information from Google Docs.

MOPSLED has the ability to retrieve a C2 address from a dead drop URL.

BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.

BADNEWS collects C2 information via a dead drop resolver.

Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.

Mini Shai-Hulud has leveraged GitHub commit-search API to recover fallback C2 domains stored in auto-created public Github repositories.

CanisterWorm can periodically poll a decentralized Internet Computer Protocol (ICP) canister to retrieve a dynamic URL for payload delivery.

Orz has used Technet and Pastebin web pages for command and control.

yty communicates to the C2 server by retrieving a Google Doc.

DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.

LOWBALL uses the Dropbox cloud storage service for command and control.

KARAE can use public cloud-based storage providers for command and control.

SLOWDRIFT uses cloud based services for C2.

ODAgent can use the Microsoft Graph API to access an attacker-controlled OneDrive account and retrieve payloads and backdoor commands.

RegDuke can use Dropbox as its C2 server.

TRANSLATEXT has used a Github repository for C2.

UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.

Kazuar has used compromised WordPress blogs as C2 servers.

POORAIM has used AOL Instant Messenger for C2.

The CALENDAR malware communicates through the use of events in Google Calendar.

ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.

Clambling can use Dropbox to download malicious payloads, send commands, and receive information.

CreepyDrive can use OneDrive for C2.

Sagerunex has used virtual private servers (VPS) for command and control traffic as well as third-party cloud services in more recent variants.

BLUELIGHT can use different cloud providers for its C2.

RogueRobin has used Google Drive as a Command and Control channel.

BoxCaon has used DropBox for C2 communications.

Crutch can use Dropbox to receive commands and upload stolen data.

Grandoreiro can utilize web services including Google sites to send and receive C2 data.

OilCheck can use a REST-based Microsoft Graph API to access draft messages in a shared Microsoft Office 365 Outlook email account used for C2 communication.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve C2 commands and payloads placed in Draft messages.

OilBooster uses the Microsoft Graph API to connect to an actor-controlled OneDrive account to download and execute files and shell commands, and to create directories to share exfiltrated data.

Revenge RAT used blogpost.com as its primary command and control server during a campaign.

LAMEHUG has used the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM to generate one-line Windows commands for the collection of system information and documents in specific folders on compromised hosts. LAMEHUG subsequently executed the returned commands and exfiltrated the collected files and information to adversary-controlled C2 servers.