Procedure examples

OSX_OCEANLOTUS.D has used a custom binary protocol over TCP port 443 for C2.

Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.

GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.

HARDRAIN binds and listens on port 443 with a FakeTLS method.

MacMa has used TCP port 5633 for C2 Communication.

PoetRAT used TLS to encrypt communications over port 143

ZxShell can use ports 1985 and 1986 in HTTP/S communication.

SPAWNCHIMERA has the ability to bind on a localhost and listen on port 8300.

njRAT has used port 1177 for HTTP C2 communications.

VIRTUALPITA has created listeners on hard coded TCP ports such as 2233, 7475, and 18098.

Covenant listeners and controllers can be configured to use non-standard ports.

QuasarRAT can use port 4782 on the compromised host for TCP callbacks.

During SharePoint ToolShell Exploitation, threat actors utilized ngrok tunnels to deliver PowerShell payloads.

During Cutting Edge, threat actors used Iodine to tunnel IPv4 traffic over DNS.

During the C0032 campaign, TEMP.Veles used encrypted SSH-based PLINK tunnels to transfer tools and enable RDP connections throughout the environment.

During C0027, Scattered Spider used SSH tunneling in targeted environments.

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the GOGETTER tunneler software to establish a “Yamux” TLS-based C2 channel with an external server(s).

During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.

Salt Typhoon has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.

FIN7 has tunneled C2 traffic via OpenSSH.

Mustang Panda has leveraged OpenSSH (sshd.exe) to execute commands, transfer files and spread across the environment communicating over SMB port 445.

Scattered Spider has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.

Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.

Cinnamon Tempest has used the Iox and NPS proxy and tunneling tools in combination create multiple connections through a single tunnel.

Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.

Ember Bear has used ProxyChains to tunnel protocols to internal networks.

Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.

Cobalt Group has used the Plink utility to create SSH tunnels.

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.

Magic Hound has used Plink to tunnel RDP over SSH.

FIN13 has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.

BRICKSTORM has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints. BRICKSTORM has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.

reGeorg can tunnel TCP sessions including RDP, SSH, and SMB through HTTP.

FLIPSIDE uses RDP to tunnel traffic from a victim environment.

Uroburos has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.

HiddenFace can hide its IP lookup by using DNS over HTTPS (DoH) for C2.

Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

Milan can use a custom protocol tunneled through DNS or HTTP.

Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.

Neo-reGeorg can tunnel data in and out of targeted networks.

FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.

SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.

Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.

LunarWeb can run a custom binary protocol under HTTPS for C2.

Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.

Kevin can use a custom protocol tunneled through DNS or HTTP.

The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.

ngrok can tunnel RDP and other services securely over internet connections.