Procedure examples

njRAT has used port 1177 for HTTP C2 communications.

VIRTUALPITA has created listeners on hard coded TCP ports such as 2233, 7475, and 18098.

Covenant listeners and controllers can be configured to use non-standard ports.

QuasarRAT can use port 4782 on the compromised host for TCP callbacks.

BRICKSTORM has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints. BRICKSTORM has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.

reGeorg can tunnel TCP sessions including RDP, SSH, and SMB through HTTP.

FLIPSIDE uses RDP to tunnel traffic from a victim environment.

Uroburos has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.

HiddenFace can hide its IP lookup by using DNS over HTTPS (DoH) for C2.

Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

Milan can use a custom protocol tunneled through DNS or HTTP.

Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.

Neo-reGeorg can tunnel data in and out of targeted networks.

FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.

SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.

Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.

LunarWeb can run a custom binary protocol under HTTPS for C2.

Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.

Kevin can use a custom protocol tunneled through DNS or HTTP.

The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.

ngrok can tunnel RDP and other services securely over internet connections.

FRP can tunnel SSH and Unix Domain Socket communications over TCP between external nodes and exposed resources behind firewalls or NAT.

Brute Ratel C4 can use DNS over HTTPS for C2.

Mythic can use SOCKS proxies to tunnel traffic through another protocol.

Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.

RCSession can use an encrypted beacon to check in with C2.

NETWIRE can encrypt C2 communications.

Gomir uses a custom encryption algorithm for content sent to command and control infrastructure.

Emotet has encrypted data before sending to the C2 server.

PowerLess can use an encrypted channel for C2 communications.

Chaes has used encryption for its C2 channel.

gh0st RAT has encrypted TCP communications to evade detection.

Cryptoistic can engage in encrypted communications with C2.

MacMa has used TLS encryption to initialize a custom protocol for C2 communications.

PowGoop can receive encrypted commands from C2.

Lizar can support encrypted communications between the client and server.

TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server.

BLINDINGCAN has encrypted its C2 traffic with RC4.

Ninja can XOR and AES encrypt C2 messages.

Earlier Pikabot variants use a custom encryption procedure leveraging multiple mechanisms including AES with multiple rounds of Base64 encoding for its command and control communication. Later Pikabot variants eliminate the use of AES and instead use RC4 encryption for transmitted information.

Bumblebee can encrypt C2 requests and responses with RC4

Torisma has encrypted its C2 communications using XOR and VEST-32.

Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.

Downdelph uses RC4 to encrypt C2 responses.

RotaJakiro encrypts C2 communication using a combination of AES, XOR, ROTATE encryption, and ZLIB compression.

Sardonic has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 servers.

The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.

KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.

TAMECAT has used AES to encrypt C2 traffic.

CASTLETAP can receive a 9-byte XOR encrypted activation string in the payload of an ICMP echo request packet.