Procedure examples

Pteranodon can use HTTP for C2.

DarkTortilla has used HTTP and HTTPS for C2.

BeaverTail has used HTTP GET request to download malicious payloads to include InvisibleFerret and HTTP POST to exfiltrate data to C2 infrastructure.

ROKRAT can use HTTP and HTTPS for command and control communication.

CORESHELL can communicate over HTTP for C2.

DarkWatchman uses HTTPS for command and control.

Dyre uses HTTPS for C2 communications.

BlackMould can send commands to C2 in the body of HTTP POST requests.

BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.

PlugX can be configured to use HTTP for command and control. PlugX has also used HTTPS for C2.

Some Reaver variants use HTTP for C2.

Bisonal has used HTTP for C2 communications.

S-Type uses HTTP for C2.

Lumma Stealer has used HTTP and HTTP for command and control communication.

SeaDuke uses HTTP and HTTPS for C2.

DustySky has used both HTTP and HTTPS for C2.

Remsec is capable of using HTTP and HTTPS for C2.

Explosive has used HTTP for communication.

Xbash uses HTTP for C2 communications.

Epic uses HTTP and HTTPS for C2 communications.

Peppy can use HTTP to communicate with C2.

KEYPLUG has the ability to communicate over HTTP and WebSocket Protocol (WSS) for C2.

DEATHRANSOM can use HTTPS to download files.

Clambling has the ability to communicate over HTTP.

Mongall can use HTTP for C2 communication.

LockBit 3.0 can use HTTP to send victim host information to C2.

SVCReady can communicate with its C2 servers via HTTP.

ThiefQuest uploads files via unencrypted HTTP.

FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.

NGLite will initially beacon out to the NKN network via an HTTP POST over TCP 30003.

The Carbanak malware communicates to its command server using HTTP with an encrypted payload.

CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.

Elise communicates over HTTP or HTTPS for C2.

Gazer communicates with its C2 servers over HTTP.

TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.

Latrodectus can send registration information to C2 via HTTP `POST`.

Saint Bot has used HTTP for C2 communications.

Chaes has used HTTP for C2 communications.

CharmPower can use HTTP to communicate with C2.

MuddyViper has used HTTP GET requests over port 443 and with the WINHTTP_FLAG_SECURE set to SSL/TLS via the WinHTTP API.

3PARA RAT uses HTTP for command and control.

Bundlore uses HTTP requests for C2.

SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.

Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.

QUADAGENT uses HTTPS and HTTP for C2 communications.

Sagerunex communicates via HTTPS, at times using a hard-coded User Agent of `Mozilla/5.0 (compatible; MSIE 7.0; Win32)`.

Sys10 uses HTTP for C2.

pngdowner uses HTTP for command and control.

GlassWorm has used HTTP for C2 and extracts data from the HTTP response headers.

Uroburos can use a custom HTTP-based protocol for large data communications that can blend with normal network traffic by riding on top of standard HTTP.