Procedure examples

KV Botnet Activity command and control traffic uses a non-standard, likely custom protocol for communication.

Mustang Panda communicated over TCP 5000 from adversary administrative servers to adversary command and control nodes during RedDelta Modified PlugX Infection Chain Operations.

During RedPenguin, UNC3886 leveraged malware that used UDP and TCP sockets for C2.

During Cutting Edge, threat actors used the Unix socket and a reverse TCP shell for C2 communications.

During C0021, the threat actors used TCP for some C2 communications.

Versa Director Zero Day Exploitation used a non-standard TCP session to initialize communication prior to establishing HTTPS command and control.

During Operation Wocao, threat actors used a custom protocol for command and control.

During the 2022 Ukraine Electric Power Attack, Sandworm Team proxied C2 communications within a TLS-based tunnel.

An APT3 downloader establishes SOCKS5 connections for its initial C2.

HAFNIUM has used TCP for C2.

FIN6 has used Metasploit Bind and Reverse TCP stagers.

Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.

Mustang Panda has utilized TCP-based reverse shells using cmd.exe.

UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.

BITTER has used TCP for C2 communications.

BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets. Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.

ToddyCat has used a passive backdoor that receives commands with UDP packets.

Metador has used TCP for C2.

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.

cd00r can monitor incoming C2 communications sent over TCP to the compromised host.

Ninja can forward TCP packets between the C2 and a remote host.

RCSession has the ability to use TCP and UDP in C2 communications.

RotaJakiro uses a custom binary protocol using a type, length, value format over TCP.

COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.

Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.

Misdat network traffic communicates over a raw socket.

reGeorg can tunnel TCP sessions into targeted networks.

BUBBLEWRAP can communicate using SOCKS.

LITTLELAMB.WOOLTEA can function as a stand-alone backdoor communicating over the `/tmp/clientsDownload.sock` socket.

InvisibleFerret has established a connection with the C2 server over TCP traffic. InvisibleFerret has also created a TCP reverse shell communicating via a socket connection over ports 1245, 80, 2245, 3001, and 5000.

Nebulae can use TCP in C2 communications.

TONESHELL has utilized TCP-based reverse shells.

RainyDay can use TCP in C2 communications.

NETWIRE can use TCP in C2 communications.

J-magic can monitor incoming C2 communications sent over TCP to the compromised host.

Aria-body has used TCP in C2 communications.

Crimson uses a custom TCP protocol for C2.

SystemBC has used raw TCP on non-standard ports, such as 4044, for C2 communications and for HTTP communications, which include downloading binaries.

PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.

Mafalda can use raw TCP for C2.

Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.

AuTo Stealer can use TCP to communicate with command and control servers.

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.

SUGARUSH has used TCP for C2.

Cuckoo Stealer can use sockets for communications to its C2 server.

InvisiMole has used TCP to download additional modules.

QUIETEXIT can establish a TCP connection as part of its initial connection to the C2.

The Regin malware platform can use ICMP to communicate between infected computers.

REPTILE can communicate using TLS over raw TCP.