Procedure examples

During the C0032 campaign, TEMP.Veles used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.

During the 2025 Poland Wiper Attacks, the adversaries had created a Reverse SOCKS Proxy and communicated over the non-standard port 8008.

During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.

Quad7 Activity has used non-standard TCP ports – such as 7777, 11288, 63256, 63210, 3256, and 3556 for C2.

An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.

MuddyWater has used ports 8043 and 8848 for botnet C2 communication.

RedEcho has used non-standard ports such as TCP 8080 for HTTP communication.

Gamaredon Group has used port 6856 for C2 communications.

FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2. FIN7 has used TCP ports 59999 and 9898 for firewall rules.

Sandworm Team has used port 6789 to accept connections on the group's SSH server.

Rocke's miner connects to a C2 server using port 51640.

Contagious Interview has used TCP port 1224 for C2.

DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.

Ember Bear has used various non-standard ports for C2 communication.

APT-C-36 has used port 4050 for C2 communications.

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.

Silence has used port 444 when sending data about the system from the client to the server.

Velvet Ant has used random high number ports for PlugX listeners on victim devices.

WIRTE has used HTTPS over ports 2083 and 2087 for C2.

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.

APT33 has used HTTP over TCP ports 808 and 880 for command and control.

Some TrickBot samples have used HTTP over ports 447 and 8082 for C2. Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443.

Pikabot uses non-standard ports, such as 2967, 2223, and others, for HTTPS command and control communication.

RotaJakiro uses a custom binary protocol over TCP port 443.

Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.

RedLeaves can use HTTP over non-standard ports, such as 995, for C2.

GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.

InvisibleFerret has been observed utilizing HTTP communications to the C2 server over ports 1224, 2245 and 8637.

Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.

StrongPity has used HTTPS over port 1402 in C2 communication.

Hannotog uses non-standard listening ports, such as UDP 5900, for command and control purposes.

Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.

The server component of SystemBC has used various TCP ports for C2 communication.

PingPull can use HTTPS over port 8080 for C2.

SUGARUSH has used port 4585 for a TCP connection to its C2.

HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.

Raspberry Robin will communicate via HTTP over port 8080 for command and control traffic.

BeaverTail has communicated with C2 IP addresses over ports 1224 or 1244.

PlugX has used random, high-number, non-standard ports to listen for subsequent actions and C2 activities.

TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.

VIRTUALPIE has created listeners on hard coded TCP port 546.

BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.

GlassWorm has distributed C2 using BitTorrent’s Distributed Hash Table (DHT) network to harness a decentralized command capability.

Metamorfo has communicated with hosts over raw TCP on port 9999.

RTM used Port 44443 for its VNC module.

Derusbi has used unencrypted HTTP on port 443 for C2.

WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.

BADCALL communicates on ports 443 and 8000 with a FakeTLS method.

MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.

HiddenFace's passive mode listens on TCP 47000.