Procedure examples

Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network.

Attor has used Tor for C2 communication.

Kobalos can chain together multiple compromised machines as proxies to reach their final targets.

Cyclops Blink has used Tor nodes for C2 traffic.

NKAbuse has abused the NKN public blockchain protocol for its C2 communications.

Industroyer used Tor nodes for C2.

Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.

Dok downloads and installs Tor via homebrew.

MacSpy uses Tor for command and control.

The FRP client can be configured to connect to the server through a proxy.

AsyncRAT can proxy C2 through a Tor client.

Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.

Mini Shai-Hulud has the ability to exfiltrate stolen credentials via the Session messenger network.

ShinyHunters has used Tor to host their DLS.

APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.

SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.

Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.

meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.

Mythic supports domain fronting via custom request headers.

Gamaredon Group has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.

FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations. Additionally, FIN7 has used malicious USBs that acted as virtual keyboards to install malware and txt files that decode to PowerShell commands.

Mustang Panda has used a customized PlugX variant which could spread through USB connections.

Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.

Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.

Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.

LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.

APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.

Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.

Ursnif has copied itself to and infected removable drives for propagation.

Crimson can spread across systems by infecting removable media.

Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.

Raspberry Robin has historically used infected USB media to spread to new victims.

Conficker variants used the Windows AUTORUN feature to spread through USB propagation.

PlugX has copied itself to infected removable drives for propagation to other victim devices.

DustySky searches for removable media and duplicates itself onto it.

USBferry can copy its installer to attached USB storage devices.

Unknown Logger is capable of spreading to USB devices.

USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.

Ramsay can spread itself by infecting other portable executable files on removable drives.

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.

njRAT can be configured to spread via removable drives.

HIUPAN has periodically checked for removable and hot-plugged drives connected to the infected machine, should one be found HIUPAN will propagate to the removeable drives by copying itself and accompanying malware components to a directory to the new drive in a hidden subdirectory `<Drive_Letter>:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\` and hides any other existing files to ensure UsbConfig.exe is the only visible file on the device.

ANDROMEDA has been spread via infected USB keys.

QakBot has the ability to use removable drives to spread through compromised networks.

H1N1 has functionality to copy itself to removable media.

Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.

APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.

USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.