Procedure examples

One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.

RIFLESPINE can retrieve C2 commands from an encrypted file on Google Drive then upload the results of command execution back to Google Drive.

BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.

ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.

PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use.

CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.

BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.

GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.

Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.

Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.

Empire can use Dropbox and GitHub for C2.

UPSTYLE parses encoded commands from error logs after attempting to resolve a non-existing webpage from the command and control server.

The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.

EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.

Sagerunex has used web services such as Twitter for command and control purposes.

Metamorfo has downloaded a zip file for execution on the system.

OnionDuke uses Twitter as a backup C2.

JumbledPath can communicate over a unique series of connections to send and retrieve data from exploited devices.

Snip3 can download and execute additional payloads and modules over separate communication channels.

After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.

Latrodectus has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.

Individual Uroburos implants can use multiple communication channels based on one of four available modes of operation.

The Bazar loader is used to download and execute the Bazar backdoor.

Valak can download additional modules and malware capable of using separate C2 channels.

BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.

LunarWeb can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.

BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.

TrickBot downloads several additional files and saves them to the victim's machine.

PowerDuke has a command to download a file.

BLINDINGCAN has downloaded files to a victim machine.

Wiarp creates a backdoor through which remote attackers can download files.

RCSession has the ability to drop additional files to an infected machine.

QuietSieve can download and execute payloads on a target host.

Bumblebee can download and execute additional payloads including through the use of a `Dex` command.

BRICKSTORM has the ability to download files from the Adversaries C2 server to the compromised system.

Amadey can download and execute files to further infect a host machine with additional malware.

NICECURL has the ability to download additional content onto an infected machine, e.g. by using `curl`.

Orz can download files onto the victim.

NOKKI has downloaded a remote module for execution.

Backdoor.Oldrea can download additional modules from C2.

DOGCALL can download and execute additional payloads.

After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.

SEASHARPEE can download remote files onto victims.

POWRUNER can download or upload files from its C2 server.

TDTESS has a command to download and execute an additional file.

SharpStage has the ability to download and execute additional payloads via a DropBox API.

Sardonic has the ability to upload additional malicious files to a compromised machine.

Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.

Misdat is capable of downloading files from the C2.

reGeorg has the ability to download files to targeted systems.