Procedure examples

During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.

Quad7 Activity has used non-standard TCP ports – such as 7777, 11288, 63256, 63210, 3256, and 3556 for C2.

During SharePoint ToolShell Exploitation, threat actors utilized ngrok tunnels to deliver PowerShell payloads.

During Cutting Edge, threat actors used Iodine to tunnel IPv4 traffic over DNS.

During the C0032 campaign, TEMP.Veles used encrypted SSH-based PLINK tunnels to transfer tools and enable RDP connections throughout the environment.

During C0027, Scattered Spider used SSH tunneling in targeted environments.

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the GOGETTER tunneler software to establish a “Yamux” TLS-based C2 channel with an external server(s).

During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.

KV Botnet Activity command and control activity includes transmission of an RSA public key in communication from the server, but this is followed by subsequent negotiation stages that represent a form of handshake similar to TLS negotiation.

In the Triton Safety Instrumented System Attack, TEMP.Veles used cryptcat binaries to encrypt their traffic.

During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.

During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.

During RedPenguin, UNC3886 malware used the RC4 cipher to encrypt outgoing C2 messages.

During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL communication module supports three commands to conduct the following actions: send implant data, execute shellcode, and terminate itself.

During Indian Critical Infrastructure Intrusions, RedEcho used SSL for network communication.

During C0021, the threat actors used SSL via TCP port 443 for C2 communications.

APT41 DUST used HTTPS for command and control.

Versa Director Zero Day Exploitation used HTTPS for command and control of compromised Versa Director servers.

During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.

Pikabot Distribution February 2024 utilized a tampered legitimate executable, `grepWinNP3.exe`, for its first stage Pikabot loader, modifying the open-source tool to execute malicious code when launched.

During C0017, APT41 established persistence by loading malicious libraries via modifications to the Import Address Table (IAT) within legitimate Microsoft binaries.

Mustang Panda used DLL search order hijacking on vulnerable applications to install PlugX payloads during RedDelta Modified PlugX Infection Chain Operations.

During the 3CX Supply Chain Attack, AppleJeus splits functionally across multiple .dll files using export functions, such as DLLGetClassObject, to execute code from an embedded .dll file within another .dll file. AppleJeus has also used DLL search order hijacking via the IKEEXT service, running with LocalSystem privileges, to load the TAXHAUL DLL for persistence.

During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.

APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP. APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.

During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.

During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs.

During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.

During SharePoint ToolShell Exploitation, threat actors registered C2 domains to spoof legitimate Microsoft domains.

Mustang Panda registered adversary-controlled domains during RedDelta Modified PlugX Infection Chain Operations that were re-registrations of expired domains.

During Operation Honeybee, threat actors registered domains for C2.

For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.

During Indian Critical Infrastructure Intrusions, RedEcho registered domains spoofing Indian critical infrastructure entities.

For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.

For C0021, the threat actors registered domains for use in C2.

For Operation Ghost, APT29 registered domains for use in C2 including some crafted to appear as existing legitimate domains.

For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.

For FunnyDream, the threat actors registered a variety of domains.

For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.

For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.

For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.

For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.

KV Botnet Activity used acquired Virtual Private Servers as control systems for devices infected with KV Botnet malware.

During the J-magic Campaign, threat actors acquired VPS for use in C2.

During the C0032 campaign, TEMP.Veles used Virtual Private Server (VPS) infrastructure.

SPACEHOP Activity has used acquired Virtual Private Servers as control systems for devices within the ORB network.

ArcaneDoor included the use of dedicated, adversary-controlled virtual private servers for command and control.

FLORAHOX Activity has used acquired Virtual Private Servers as control systems for the ORB network.

During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.

For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.