Procedure examples

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.

Silence has used port 444 when sending data about the system from the client to the server.

Velvet Ant has used random high number ports for PlugX listeners on victim devices.

WIRTE has used HTTPS over ports 2083 and 2087 for C2.

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.

APT33 has used HTTP over TCP ports 808 and 880 for command and control.

Salt Typhoon has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.

FIN7 has tunneled C2 traffic via OpenSSH.

Mustang Panda has leveraged OpenSSH (sshd.exe) to execute commands, transfer files and spread across the environment communicating over SMB port 445.

Scattered Spider has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.

Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.

Cinnamon Tempest has used the Iox and NPS proxy and tunneling tools in combination create multiple connections through a single tunnel.

Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.

Ember Bear has used ProxyChains to tunnel protocols to internal networks.

Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.

Cobalt Group has used the Plink utility to create SSH tunnels.

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.

Magic Hound has used Plink to tunnel RDP over SSH.

FIN13 has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.

Tropic Trooper has encrypted traffic with the C2 to prevent network detection.

BITTER has encrypted their C2 communications.

APT29 has used multiple layers of encryption within malware to protect C2 communication.

Magic Hound has used an encrypted http proxy in C2 communications.

Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.

MuddyWater has used AES to encrypt C2 responses.

Mustang Panda has encrypted C2 communications with RC4. Mustang Panda has also leveraged encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.

ZIRCONIUM has used AES encrypted communications in C2.

Contagious Interview has encrypted C2 traffic using RC4.

Higaisa used AES-128 to encrypt C2 traffic.

RedCurl has used AES-128 CBC to encrypt C2 communications.

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.

Darkhotel has used AES-256 and 3DES for C2 communications.

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.

Inception has encrypted network communications with AES.

APT33 has used AES for encryption of command and control traffic.

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.

RedEcho uses SSL for network communication.

TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.

OilRig used the PowerExchange utility and other tools to create tunnels to C2 servers.

Tropic Trooper has used SSL to connect to C2 servers.

RedCurl has used HTTPS for C2 communication.

Medusa Group has used HTTPS for command and control.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

Cobalt Group has used the Plink utility to create SSH tunnels.

Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.