Procedure examples

Emotet has used HTTP for command and control.

SNUGRIDE communicates with its C2 server over HTTP.

BOLDMOVE uses web services for command and control communication.

Crimson can use a HTTP GET request to download its final payload.

Tomiris can use HTTP to establish C2 communications.

Turian has the ability to use HTTP for its C2.

THINCRUST can use HTTP POST requests in C2 communications.

BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.

Machete uses HTTP for Command & Control.

Action RAT can use HTTP to communicate with C2 servers.

Avenger has the ability to use HTTP in communication with C2.

PUBLOAD has communicated via `curl` over HTTP to identify device IP data. PUBLOAD has also utilized HTTP for a command-and-control protocol through HTTP POST. PUBLOAD has also leveraged HTTPS for C2.

A PingPull variant can communicate with its C2 servers by using HTTPS.

WellMess can use HTTP and HTTPS in C2 communications.

Dacls can use HTTPS in C2 communications.

Woody RAT can communicate with its C2 server using HTTP requests.

Mafalda can use HTTP for C2.

Squirrelwaffle has used HTTP POST requests for C2 communications.

ELMER uses HTTP for command and control.

PolyglotDuke has has used HTTP GET requests in C2 communications.

HexEval Loader has used HTTP and HTTPS POST requests to communicate with C2.

AuTo Stealer can use HTTP to communicate with its C2 servers.

ShrinkLocker uses HTTP POST requests to communicate victim information back to the threat actor.

FlawedAmmyy has used HTTP for C2.

Cuckoo Stealer can use the curl API for C2 communications.

GuLoader can use HTTP to retrieve additional binaries.

InvisiMole uses HTTP for C2 communications.

P.A.S. Webshell can issue commands via HTTP POST.

WhisperGate can make an HTTPS connection to download additional files.

ZeroT has used HTTP for C2.

Keydnap uses HTTPS for command and control.

RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.

Okrum uses HTTP for communication with its C2.

TRANSLATEXT has used HTTP to communicate with the C2 server.

The Regin malware platform supports many standard protocols, including HTTP and HTTPS.

Line Dancer uses HTTP POST requests to interact with compromised devices.

Neoichor can use HTTP for C2 communications.

Raspberry Robin uses outbound HTTP requests containing victim information for retrieving second stage payloads. Variants of Raspberry Robin can download archive files (such as 7-Zip files) via the victim web browser for second stage execution.

Diavol has used HTTP GET and POST requests for C2.

Doki has communicated with C2 over HTTPS.

RustyWater has used the Rust request library for HTTP C2 communication.

IcedID has used HTTPS in communications with C2.

VERMIN uses HTTP for C2 communications.

UBoatRAT has used HTTP for C2 communications.

HTTPTroy has used HTTP POST requests to communicate with C2.

MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.

PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.

Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.

DarkComet can use HTTP for C2 communications.

NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.