Procedure examples

JumbledPath can communicate over a unique series of connections to send and retrieve data from exploited devices.

Snip3 can download and execute additional payloads and modules over separate communication channels.

After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.

Latrodectus has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.

Individual Uroburos implants can use multiple communication channels based on one of four available modes of operation.

The Bazar loader is used to download and execute the Bazar backdoor.

Valak can download additional modules and malware capable of using separate C2 channels.

BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.

LunarWeb can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.

BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.

During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.

KV Botnet Activity included the use of scripts to download additional payloads when compromising network nodes.

During SharePoint ToolShell Exploitation, threat actors used a loader to download and execute ransomware.

During Frankenstein, the threat actors downloaded files and tools onto a victim machine.

During RedPenguin, UNC3886 used backdoor malware capable of downloading files to compromised infrastructure.

During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.

During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.

During Operation MidnightEclipse, threat actors downloaded additional payloads on compromised devices.

During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.

During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.

Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.

During ShadowRay, threat actors downloaded and executed the XMRig miner on targeted hosts.

During C0021, the threat actors downloaded additional tools and files onto victim machines.

During C0015, the threat actors downloaded additional tools and files onto a compromised network.

During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.

During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.

During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.

During Outer Space, OilRig downloaded additional tools to comrpomised infrastructure.

During the 2025 Poland Wiper Attacks, the adversaries downloaded malicious payloads to the victim server.

During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.

APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.

During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.

During Operation Wocao, threat actors downloaded additional files to the infected system.

During C0017, APT41 downloaded malicious payloads onto compromised systems.

During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.

During C0027, Scattered Spider downloaded tools using victim organization systems.

Quad7 Activity has downloaded additional binaries from a remote File Transfer Protocol (FTP) server to compromised devices.

During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine. Additionally, APT38 has downloaded other payloads onto a victim’s machine.

Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.

BlackByte has transferred tools such as Cobalt Strike to victim environments from file sharing and hosting websites.

The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.

SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.

GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.

APT3 has a tool that can copy files to remote machines.

Mustard Tempest has deployed secondary payloads and third stage implants to compromised hosts.

Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.

Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.

Patchwork payloads download additional files from the C2 server.