Procedure examples

APT18 uses HTTP for C2 communications.

Sidewinder has used HTTP in C2 communications.

Mustang Panda has communicated with its C2 via HTTP POST requests.

Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.

APT39 has used HTTP in communications with C2.

APT37 uses HTTPS to conceal C2 communications.

OilRig has used HTTP for C2.

Higaisa used HTTP and HTTPS to send data back to its C2 server.

Tropic Trooper has used HTTP in communication with the C2.

Orangeworm has used HTTP for C2.

Sea Turtle connected over TCP using HTTP to establish command and control channels.

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.

Confucius has used HTTP for C2 communications.

Winter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.

SilverTerrier uses HTTP for C2 communications.

Turla has used HTTP and HTTPS for C2 communications.

TA505 has used HTTP to communicate with C2 nodes.

BITTER has used HTTP POST requests for C2.

RedCurl has used HTTP, HTTPS and Webdav protocls for C2 communications.

Stealth Falcon malware communicates with its C2 server via HTTPS.

Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.

Chimera has used HTTPS for C2 communications.

Medusa Group has communicated through reverse or bind shells over port 443 (HTTPS).

BRONZE BUTLER malware has used HTTP for C2.

TA551 has used HTTP for C2 communications.

Windshift has used tools that communicate with C2 over HTTP.

LuminousMoth has used HTTP for C2.

Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.

Metador has used HTTP for C2.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

Lazarus Group has conducted C2 over HTTP and HTTPS.

FIN4 has used HTTP POST requests to transmit data.

Cobalt Group has used HTTPS for C2.

Wizard Spider has used HTTP for network communications.

Moonstone Sleet used curl to connect to adversary-controlled infrastructure and retrieve additional payloads.

Inception has used HTTP, HTTPS, and WebDav in network communications.

VOID MANTICORE has utilized HTTPS for communication to C2 domains.

Daggerfly uses HTTP for command and control communication.

Rancor has used HTTP for C2.

WIRTE has used HTTP for network communication.

Magic Hound has used HTTP for C2.

Threat Group-3390 malware has used HTTP for C2.

APT33 has used HTTP for command and control.

FIN8 has used HTTPS for command and control.

FIN13 has used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data.

APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.

TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

BLINDINGCAN has used HTTPS over port 443 for command and control.

Ninja can use HTTP for C2 communications.

RCSession can use HTTP in C2 communications.