Procedure examples

Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.

CharmPower can send victim data via FTP with credentials hardcoded in the script.

KONNI has used FTP to exfiltrate reconnaissance data out.

CORALDECK has exfiltrated data in HTTP POST headers.

ccf32 can upload collected data and files to an FTP server.

WARPWIRE can send captured credentials to C2 via HTTP `GET` or `POST` requests.

Cherry Picker exfiltrates files over FTP.

Carbon uses HTTP to send data to the C2 server.

Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.

PoetRAT has used ftp for exfiltration.

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.

CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP.

Dok exfiltrates logs of its execution stored in the /tmp folder over FTP using the curl command.

Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.

BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.

ftp may be used to exfiltrate data separate from the main command and control protocol.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to map internal network architecture and access relationships.

During FunnyDream, the threat actors used netstat to discover network connections on remote systems.

During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.

During the 2025 Poland Wiper Attacks, the adversaries identified network connections utilizing `netstat -nao` and `netstat -r`.

During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.

GALLIUM used netstat -oan to obtain information about the victim network connections.

APT3 has a tool that can enumerate current network connections.

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download

Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.

menuPass has used net use to conduct connectivity checks to machines.

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.

TeamTNT has run netstat -anp to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify /etc/ld.so.preload.

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.

Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.

Mustang Panda has used netstat -ano to determine network connection information.

OilRig has used netstat -an on a victim to get a listing of network connections.

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.

Ke3chang performs local network connection discovery using netstat.

APT1 used the net use command to get a listing on network connections.

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

Poseidon Group obtains and saves information about victim network interfaces and addresses.

Lotus Blossom has used commands such as `netstat` to identify system network connections.

Chimera has used netstat -ano | findstr EST to discover network connections.

BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.

ToddyCat has used `netstat -anop tcp` to discover TCP connections to compromised hosts.

APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.

Lazarus Group has used net use to identify and establish a network connection with a remote host.

INC Ransom has used RDP to test network connections.

Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational”
(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.

Velvet Ant has enumerated existing network connections on victim devices.

HEXANE has used netstat to monitor connections to specific ports.