Procedure examples

TrailBlazer has used HTTP requests for C2.

MOPSLED can communicate to C2 nodes over HTTP.

More_eggs uses HTTPS for C2.

OutSteel has used HTTP for C2 communications.

BackConfig has the ability to use HTTPS for C2 communiations.

PowGoop can send HTTP GET requests to malicious servers.

BoomBox has used HTTP POST requests for C2.

LAMEHUG can use HTTP POST requests to exfiltrate data from compromised hosts to C2.

Mango can retrieve C2 commands sent in HTTP responses.

WIREFIRE can respond to specific HTTP `POST` requests to `/api/v1/cav/client/visits`.

GrimAgent has the ability to use HTTP for C2 communications.

LookBack’s C2 proxy tool sends data to a C2 server over HTTP.

STEADYPULSE can parse web requests made to a targeted server to determine the next stage of execution.

YAHOYAH uses HTTP for C2.

Lokibot has used HTTP for C2 communications.

One variant of CloudDuke uses HTTP and HTTPS for C2.

Egregor has communicated with its C2 servers via HTTPS protocol.

PoetRAT has used HTTP and HTTPs for C2 communications.

Various implementations of CHOPSTICK communicate with C2 over HTTP.

StealBit can use HTTP to exfiltrate files to actor-controlled infrastructure.

FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.

ZxShell has used HTTP for C2 connections.

RIFLESPINE can use HTTP `GET` and `PUT` to upload and download files.

SLIGHTPULSE has the ability to process HTTP GET requests as a normal web server and to insert logic that will read or write files or execute commands in response to HTTP POST requests.

CreepySnail can use HTTP for C2.

Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.

Troll Stealer uses HTTP to communicate to command and control infrastructure.

Kinsing has communicated with C2 over HTTP.

njRAT has used HTTP for C2 communications.

Maze has communicated to hard-coded IP addresses via HTTP.

ComRAT has used HTTP requests for command and control.

ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.

ANDROMEDA has the ability to make GET requests to download files from C2.

Manjusaka has used HTTP for command and control communication.

IceApple can use HTTP GET to request and pull information from C2.

Shai-Hulud has utilized curl to install Bun over HTTPS.

metaMain can use HTTP for C2 communications.

SideTwist has used HTTP GET and POST requests over port 443 for C2.

MechaFlounder has the ability to use HTTP in communication with C2.

Psylo uses HTTPS for C2.

HTTPBrowser has used HTTP and HTTPS for command and control.

Mis-Type network traffic can communicate over HTTP.

LunarWeb can use `POST` to send victim identification to C2 and `GET` to retrieve commands.

Dipsind uses HTTP for C2.

Octopus has used HTTP GET and POST requests for C2 communications.

AppleJeus has sent data to its C2 server via POST requests.

SoreFang can use HTTP in C2 communications.

STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.

Industroyer’s main backdoor connected to a remote C2 server using HTTPS.

DownPaper communicates to its C2 server over HTTP.