Procedure examples

Sibot communicated with its C2 server via HTTP GET requests.

Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.

Shark has the ability to use HTTP in C2 communications.

Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.

PULSECHECK can check HTTP request headers for a specific backdoor key and if found will output the result of the command in the variable `HTTP_X_CMD.`

BadPatch uses HTTP for C2.

RATANKBA uses HTTP/HTTPS for command and control communication.

A SUGARDUMP variant has used HTTP for C2.

XLoader uses HTTP and HTTPS for command and control communication.

ABK has the ability to use HTTP in communications with C2.

Final1stspy uses HTTP for C2.

Kapeka utilizes HTTP for command and control.

Zebrocy uses HTTP for C2.

Pandora can communicate over HTTP.

SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.

OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.

Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.

SampleCheck5000 can use the Exchange Web Services API for C2 communication.

SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.

EvilBunny has executed C2 commands directly via HTTP.

ServHelper uses HTTP for C2.

REvil has used HTTP and HTTPS in communication with C2.

APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.

Valak has used HTTP in communications with C2.

Samurai can use a .NET HTTPListener class to receive and handle HTTP POST requests.

PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.

Milan can use HTTPS for communication with C2.

OSX_OCEANLOTUS.D can also use use HTTP POST and GET requests to send and receive C2 information.

OilBooster can send HTTP `GET`, `POST`, `PUT`, and `DELETE` requests to the Microsoft Graph API over port 443 for C2 communication.

OnionDuke uses HTTP and HTTPS for C2.

Taidoor has used HTTP GET and POST requests for C2.

SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.

Cyclops Blink can download files via HTTP and HTTPS.

Seasalt uses HTTP for C2 communications.

PLEAD has used HTTP for communications with command and control (C2) servers.

Raccoon Stealer uses HTTP, and particularly HTTP POST requests, for command and control actions.

IPsec Helper connects to command and control servers via HTTP POST requests based on parameters hard-coded into the malware.

Daserf uses HTTP for C2.

GoldFinder has used HTTP for C2.

Carbon can use HTTP in C2 communications.

Cardinal RAT is downloaded using HTTP over port 443.

DanBot can use HTTP in C2 communication.

GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.

Gold Dragon uses HTTP for communication to the control servers.

RGDoor uses HTTP for C2 communications.

Ramsay has used HTTP for C2.

Neo-reGeorg can use customized HTTP headers.

AshTag can use HTTP to send and receive data from C2.

Carberp has connected to C2 servers via HTTP.

FRAMESTING can retrieve C2 commands from values stored in the `DSID` cookie from the current HTTP request or from decompressed zlib data within the request's `POST` data.