Procedure examples

CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.

Variants of Kevin can communicate with C2 over HTTP.

Agent Tesla has used HTTP for C2 communications.

httpclient uses HTTP for command and control.

POWERTON has used HTTP/HTTPS for C2 traffic.

BADNEWS establishes a backdoor over HTTP.

Goopy has the ability to communicate with its C2 over HTTP.

ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.

Remexi uses BITSAdmin to communicate with the C2 server over HTTP.

QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.

Gelsemium can use HTTP/S in C2 communications.

Helminth can use HTTP for C2.

Dridex has used POST requests and HTTPS for C2 communications.

BBK has the ability to use HTTP in communications with C2.

The Komplex C2 channel uses HTTP POST requests.

Comnie uses HTTP for C2 communication.

Vasport creates a backdoor by making a connection using a HTTP POST.

MacSpy uses HTTP for command and control.

BACKSPACE uses HTTP as a transport to communicate with its command server.

UPPERCUT has used HTTP for C2, including sending error codes in cookie headers.

ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.

SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.

XORIndex Loader has used HTTPS POST to communicate with C2.

Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.

Covenant can establish command and control via HTTP.

ShimRatReporter communicated over HTTP with preconfigured C2 servers.

Sliver has the ability to support C2 communications over HTTP and HTTPS.

evilginx2 can proxy HTTPS connections between victims and destination websites.

Empire can conduct command and control over protocols like HTTP and HTTPS.

FRP has the ability to use HTTP and HTTPS to enable the forwarding of requests for internal services via domain name.

PcShare has used HTTP for C2 communication.

PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.

CSPY Downloader can use GET requests to download additional payloads from C2.

Brute Ratel C4 can use HTTPS and HTTPS for C2 communication.

Out1 can use HTTP and HTTPS in communications with remote hosts.

MCMD can use HTTPS in communication with C2 web servers.

Donut can use HTTP to download previously staged shellcode payloads.

Koadic has used HTTP for C2 communications.

Pupy can communicate over HTTP for C2.

Mythic supports HTTP-based C2 profiles.

Quick Assist communicates over TCP 443 via HTTPS to a remote session server, under which RDP traffic is transferred.

TeamPCP Cloud Stealer has used `curl` to upload stolen data to attacker controlled domains.

Mini Shai-Hulud has has exfiltrated data through the use of HTTPS POST requests to C2 domains.

Kali365's desktop client has made Microsoft Graph API calls using the distinct User-Agent string `kali365-live/1.0.0` to access victim mailboxes and enumerate account data following OAuth token capture.