Procedure examples

BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.

Machete uses FTP for Command & Control.

PUBLOAD has used `curl` for data exfiltration over FTP.

The Regin malware platform supports many standard protocols, including SMB.

Kazuar uses FTP and FTPS to communicate with the C2 server.

XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.

Attor has used FTP protocol for C2 communication.

Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

PoetRAT has used FTP for C2 communications.

ZxShell has used FTP for C2 connections.

JPIN can communicate over FTP.

Disco can use SMB to transfer files.

Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.

ShadowPad has used FTP for C2 communications.

SYSCON has the ability to use FTP in C2 communications.

CARROTBALL has the ability to use FTP in C2 communications.

Mythic supports SMB-based peer-to-peer C2 profiles.

Kimsuky has used e-mail to send exfiltrated data to C2 servers.

APT32 has used email for C2 via an Office macro.

Contagious Interview has utilized email notifications from malware distribution servers to track victim engagement.

SilverTerrier uses SMTP for C2 communications.

Turla has used multiple backdoors which communicate with a C2 server via email attachments.

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.

PowerExchange can receive and send back the results of executed C2 commands through email.

OLDBAIT can use SMTP for C2.

IMAPLoader uses the IMAP email protocol for command and control purposes.

RDAT can use email attachments for C2 communications.

NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.

CORESHELL can communicate over SMTP and POP3 for C2.

Remsec is capable of using SMTP for C2.

LightNeuron uses SMTP for C2.

Uroburos can use custom communications protocols that ride over SMTP.

NightClub can use emails for C2 communications.

BadPatch uses SMTP for C2.

A SUGARDUMP variant used SMTP for C2.

Zebrocy uses SMTP and POP3 for C2.

LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.

ComRAT can use email attachments for command and control.

JPIN can send email over SMTP.

Agent Tesla has used SMTP for C2 communications.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

During Cutting Edge, threat actors used DNS to tunnel IPv4 C2 traffic.

APT41 used DNS for C2 communications.

FIN7 has performed C2 using DNS via A, OPT, and TXT records.

APT18 uses DNS for C2 communications.

APT39 has used remote access tools that leverage DNS in communications with C2.

OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.

Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.