Procedure examples

Exaramel for Linux uses HTTPS for C2 communications.

BUBBLEWRAP can communicate using HTTP or HTTPS.

HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.

TAMECAT has used HTTP for C2 communications.

Ursnif has used HTTPS for C2.

ZLib communicates over HTTP for C2.

RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.

Tsundere Botnet has obtained the WebSocket C2 address by making remote procedure call (RPC) APIs to Ethereum blockchain nodes.

Felismus uses HTTP for C2.

Zeus Panda uses HTTP for C2 communications.

GeminiDuke uses HTTP and HTTPS for command and control.

Havoc can use HTTP/S listeners to establish and maintain C2 communications.

GravityRAT uses HTTP for C2.

InvisibleFerret has used HTTP for C2 communications.

Bankshot uses HTTP for command and control communication.

StrongPity can use HTTP and HTTPS in C2 communications.

xCaon has communicated with the C2 server by sending POST requests over HTTP.

Pony has sent collected information to the C2 via HTTP POST request.

WinMM uses HTTP for C2.

TONESHELL has utilized HTTP for a C2 protocol through HTTP POST. TONESHELL has also utilized HTTPS for C2.

RainyDay can use HTTP in C2 communications.

AppleSeed has the ability to communicate with C2 over HTTP.

LOWBALL command and control occurs via HTTPS over port 443.

NETWIRE has the ability to communicate over HTTP.

TinyTurla can use HTTPS in C2 communications.

BOOKWORM has communicated with its C2 via HTTP POST requests.

The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.

OLDBAIT can use HTTP for C2.

CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.

GreyEnergy uses HTTP and HTTPS for C2 communications.

Gomir periodically communicates to its command and control infrastructure through HTTP POST requests.

Aria-body has used HTTP in C2 communications.

Emotet has used HTTP for command and control.

SNUGRIDE communicates with its C2 server over HTTP.

BOLDMOVE uses web services for command and control communication.

Crimson can use a HTTP GET request to download its final payload.

Tomiris can use HTTP to establish C2 communications.

Turian has the ability to use HTTP for its C2.

THINCRUST can use HTTP POST requests in C2 communications.

BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.

Machete uses HTTP for Command & Control.

Action RAT can use HTTP to communicate with C2 servers.

Avenger has the ability to use HTTP in communication with C2.

PUBLOAD has communicated via `curl` over HTTP to identify device IP data. PUBLOAD has also utilized HTTP for a command-and-control protocol through HTTP POST. PUBLOAD has also leveraged HTTPS for C2.

A PingPull variant can communicate with its C2 servers by using HTTPS.

WellMess can use HTTP and HTTPS in C2 communications.

Dacls can use HTTPS in C2 communications.

Woody RAT can communicate with its C2 server using HTTP requests.

Mafalda can use HTTP for C2.

Squirrelwaffle has used HTTP POST requests for C2 communications.