Procedure examples

Octopus has exfiltrated data to file sharing sites.

Pcexter can upload stolen files to OneDrive storage accounts via HTTP `POST`.

Empire can use Dropbox for data exfiltration.

Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.

During the 2025 Poland Wiper Attacks, the adversaries leveraged an attacker-controlled Slack channel to exfiltrate data.

Shai-Hulud has exfiltrated repository secrets to `webhook[.]site`.

For Operation Dust Storm, the threat actors used dynamic DNS domains from a variety of free providers, including No-IP, Oray, and 3322.

During Indian Critical Infrastructure Intrusions, RedEcho used dynamic DNS domains associated with malicious infrastructure.

For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.

During the SolarWinds Compromise, APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.

During Night Dragon, threat actors used dynamic DNS services for C2.

During C0026, the threat actors re-registered a ClouDNS dynamic DNS subdomain which was previously used by ANDROMEDA.

Kimsuky has used Dynamic DNS (DDNS) services, such as FreeDNS or No-IP DDNS, to include servers located in South Korea.

RedEcho used dynamic DNS domains associated with malicious infrastructure.

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.

TA2541 has used dynamic DNS services for C2 infrastructure.

BITTER has used DDNS for C2 communications.

APT29 has used Dynamic DNS providers for their malware C2 infrastructure.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

Transparent Tribe has used dynamic DNS services to set up C2.

BRICKSTORM has utilized DNS services sslip.io and nip.io to resolve C2 IP addresses.

Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.

NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.

Bisonal has used a dynamic DNS service for C2.

RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.

SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.

Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.

Gelsemium can use dynamic DNS domain names in C2.

AsyncRAT can be configured to use dynamic DNS.

Remcos has used dynamic DNS domains in C2 communications.

menuPass has used dynamic DNS service providers to host malicious domains.

Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses. Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.

TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.

Amadey has used fast flux DNS for its C2.

gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.

njRAT has used a fast flux DNS for C2 IP resolution.

APT41 has used DGAs to change their C2 servers monthly.

TA551 has used a DGA to generate URLs from executed macros.

Ursnif has used a DGA to generate domain names for C2.

Aria-body has the ability to use a DGA for C2 communications.

SombRAT can use a custom DGA to generate a subdomain for C2.

Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.

Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.

POSHSPY uses a DGA to derive command and control URLs from a word list.

MiniDuke can use DGA to generate new Twitter URLs for C2.

DarkWatchman has used a DGA to generate a domain name for C2.

Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.

Shark can send DNS C2 communications using a unique domain generation algorithm.

Bazar can implement DGA using the current date as a seed variable.

HiddenFace has used dynamic domain generation algorithms in C2.