Procedure examples

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.

Medusa Group has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.

TA578 has used Google Firebase to host malicious scripts.

LazyScripter has established GitHub accounts to host its toolsets.

APT28 has used newly-created Blogspot pages for credential harvesting operations.

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.

Lazarus Group has hosted malicious downloads on Github.

Earth Lusca has established GitHub accounts to host their malware.

IndigoZebra created Dropbox accounts for their operations.

VOID MANTICORE has obtained access to commercial VPN services to launch malicious activity. VOID MANTICORE has also leveraged Starlink internet services. VOID MANTICORE has used operator-controlled Telegram bots and channels as C2 infrastructure.

Magic Hound has acquired Amazon S3 buckets to use in C2.

TeamPCP has set up Clouflare Tunnels for malware C2. TeamPCP has also used the session messenger network for decentralized, encrypted exfiltration via  *.getsession[.]org to recipient  ID `05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026`.

APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.

Mustard Tempest has posted false advertisements including for software packages and browser updates in order to distribute malware.

Raspberry Robin variants have been delivered via malicious advertising items that, when interacted with, download a malicious archive file containing the initial payload, hosted on services such as Discord.

Indian Critical Infrastructure Intrusions included the use of compromised infrastructure, such as DVR and IP camera devices, for command and control purposes in ShadowPad activity.

During APT28 Nearest Neighbor Campaign, APT28 compromised third-party infrastructure in physical proximity to targets of interest for follow-on activities.

For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.

For C0021, the threat actors used legitimate but compromised domains to host malicious payloads.

For the SolarWinds Compromise, APT29 compromised domains to use for C2.

During the 2025 Poland Wiper Attacks, the adversaries compromised infrastructure to use for C2.

During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.

SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.

Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.

Kimsuky has compromised legitimate sites and used them to distribute malware.

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.

Transparent Tribe has compromised domains for use in targeted malicious campaigns.

Magic Hound has used compromised domains to host links targeted to specific phishing victims.

Gootloader has used compromised legitimate domains to as a delivery network for malicious payloads.

Sea Turtle modified Name Server (NS) items to refer to Sea Turtle-controlled DNS servers to provide responses for all DNS lookups.

LAPSUS$ has reconfigured a victim's DNS records to actor-controlled domains and websites.

During Operation MidnightEclipse, threat actors abused Virtual Private Servers to store malicious files.

During the 2025 Poland Wiper Attacks, the adversaries used compromised VPS servers for C2.

Volt Typhoon has compromised Virtual Private Servers (VPS) to proxy C2 traffic.

Turla has used the VPS infrastructure of compromised Iranian threat actors.

For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.

For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.

During the Anthropic AI-orchestrated Campaign, the adversary operated dedicated penetration testing servers accessible via MCP to support remote command execution, simultaneous tool coordination, and persistent operational state maintenance across campaign sessions.

During Juicy Mix, OilRig compromised an Israeli job portal to use for a C2 server.

During Outer Space, OilRig compromised an Israeli human resources site to use as a C2 server.

During Night Dragon, threat actors compromised web servers to use for C2.

Indrik Spider has served fake updates via legitimate websites that have been compromised.

Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.

Dragonfly has compromised legitimate websites to host C2 and malware modules.

Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.

Leviathan has used compromised legitimate websites as command and control nodes for operations.

Turla has used compromised servers as infrastructure.

Lazarus Group has compromised servers to stage malicious tools.

Earth Lusca has used compromised web servers as part of their operational infrastructure.

APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.