Procedure examples

BITTER has used HTTP POST requests for C2.

RedCurl has used HTTP, HTTPS and Webdav protocls for C2 communications.

Stealth Falcon malware communicates with its C2 server via HTTPS.

Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.

Chimera has used HTTPS for C2 communications.

Medusa Group has communicated through reverse or bind shells over port 443 (HTTPS).

BRONZE BUTLER malware has used HTTP for C2.

TA551 has used HTTP for C2 communications.

Windshift has used tools that communicate with C2 over HTTP.

LuminousMoth has used HTTP for C2.

Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.

Metador has used HTTP for C2.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

Lazarus Group has conducted C2 over HTTP and HTTPS.

FIN4 has used HTTP POST requests to transmit data.

Cobalt Group has used HTTPS for C2.

Wizard Spider has used HTTP for network communications.

Moonstone Sleet used curl to connect to adversary-controlled infrastructure and retrieve additional payloads.

Inception has used HTTP, HTTPS, and WebDav in network communications.

VOID MANTICORE has utilized HTTPS for communication to C2 domains.

Daggerfly uses HTTP for command and control communication.

Rancor has used HTTP for C2.

WIRTE has used HTTP for network communication.

Magic Hound has used HTTP for C2.

Threat Group-3390 malware has used HTTP for C2.

APT33 has used HTTP for command and control.

FIN8 has used HTTPS for command and control.

FIN13 has used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data.

APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.

Kimsuky has used FTP to download additional malware to the target machine.

APT41 used exploit payloads that initiate download via ftp.

Dragonfly has used SMB for C2.

SilverTerrier uses FTP for C2 communications.

MirrorFace has used the the PuTTY suite Secure Copy Protocol (SCP) client for file transfer.

Kimsuky has used e-mail to send exfiltrated data to C2 servers.

APT32 has used email for C2 via an Office macro.

Contagious Interview has utilized email notifications from malware distribution servers to track victim engagement.

SilverTerrier uses SMTP for C2 communications.

Turla has used multiple backdoors which communicate with a C2 server via email attachments.

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.

APT41 used DNS for C2 communications.

FIN7 has performed C2 using DNS via A, OPT, and TXT records.

APT18 uses DNS for C2 communications.

APT39 has used remote access tools that leverage DNS in communications with C2.

OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.

Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.

Ke3chang malware RoyalDNS has used DNS for C2.

Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.

Ember Bear has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.

LazyScripter has leveraged dynamic DNS providers for C2 communications.