Procedure examples

PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.

Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.

DarkComet can use HTTP for C2 communications.

NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.

CHIMNEYSWEEP can send `HTTP GET` requests to  C2.

FatDuke can be controlled via a custom C2 protocol over HTTP.

BlackEnergy communicates with its C2 server over HTTP.

DRATzarus can use HTTP or HTTPS for C2 communications.

Rising Sun has used HTTP and HTTPS for command and control.

ShimRat communicated over HTTP and HTTPS with C2 servers.

Flagpro can communicate with its C2 using HTTP.

Hi-Zor communicates with its C2 server over HTTPS.

China Chopper's server component executes code sent via HTTP POST commands.

SnappyTCP connects to the command and control server via a TCP socket using HTTP.

LightSpy's C2 communication is performed over WebSockets using the open source library SocketRocket with functionality such as, heartbeat, receiving commands, and updating command status.

PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.

GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.

LIGHTWIRE can use HTTP for C2 communications.

MiniDuke uses HTTP and HTTPS for command and control.

HyperBro has used HTTPS for C2 communications.

Anchor has used HTTP and HTTPS in C2 communications.

Line Runner utilizes an HTTP-based Lua backdoor on victim machines.

Pteranodon can use HTTP for C2.

DarkTortilla has used HTTP and HTTPS for C2.

BeaverTail has used HTTP GET request to download malicious payloads to include InvisibleFerret and HTTP POST to exfiltrate data to C2 infrastructure.

ROKRAT can use HTTP and HTTPS for command and control communication.

CORESHELL can communicate over HTTP for C2.

DarkWatchman uses HTTPS for command and control.

Dyre uses HTTPS for C2 communications.

BlackMould can send commands to C2 in the body of HTTP POST requests.

BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.

PlugX can be configured to use HTTP for command and control. PlugX has also used HTTPS for C2.

Some Reaver variants use HTTP for C2.

Bisonal has used HTTP for C2 communications.

S-Type uses HTTP for C2.

Lumma Stealer has used HTTP and HTTP for command and control communication.

SeaDuke uses HTTP and HTTPS for C2.

DustySky has used both HTTP and HTTPS for C2.

Remsec is capable of using HTTP and HTTPS for C2.

Explosive has used HTTP for communication.

Xbash uses HTTP for C2 communications.

Epic uses HTTP and HTTPS for C2 communications.

Peppy can use HTTP to communicate with C2.

KEYPLUG has the ability to communicate over HTTP and WebSocket Protocol (WSS) for C2.

DEATHRANSOM can use HTTPS to download files.

Clambling has the ability to communicate over HTTP.

Mongall can use HTTP for C2 communication.

LockBit 3.0 can use HTTP to send victim host information to C2.

SVCReady can communicate with its C2 servers via HTTP.

ThiefQuest uploads files via unencrypted HTTP.