Procedure examples

Metamorfo has used HTTP for C2.

Trojan.Karagany can communicate with C2 via HTTP POST requests.

MagicRAT uses HTTP POST communication for command and control.

KONNI has used HTTP POST for C2.

Winnti for Linux has used HTTP in outbound communications.

Shamoon has used HTTP for C2.

JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.

BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.

KGH_SPY can send data to C2 with HTTP POST requests.

down_new has the ability to use HTTP in C2 communications.

Ixeshe uses HTTP for command and control.

Micropsia uses HTTP and HTTPS for C2 network communications.

RedLine Stealer has utilized HTTP for C2 communications. RedLine Stealer has also conducted C2 communications to hardcoded C2 servers over HTTPS. RedLine Stealer has leveraged SOAP protocol for C2 communications.

VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.

OopsIE uses HTTP for C2 communications.

4H RAT uses HTTP for command and control.

DealersChoice uses HTTP for communication with the C2 server.

LitePower can use HTTP and HTTPS for C2 communications.

Crutch has conducted C2 communications with a Dropbox account using the HTTP API.

RTM has initiated connections to external domains using HTTPS.

QUIETCANARY can use HTTPS for C2 communications.

PHPsert can retrieve remote files using HTTP POST.

Hikit has used HTTP for C2.

StrelaStealer communicates externally via HTTP POST with encrypted content.

Grandoreiro has the ability to use HTTP in C2 communications.

LiteDuke can use HTTP GET requests in C2 communications.

Sakula uses HTTP for C2.

VaporRage can use HTTP to download shellcode from compromised websites.

Sibot communicated with its C2 server via HTTP GET requests.

Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.

Shark has the ability to use HTTP in C2 communications.

Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.

PULSECHECK can check HTTP request headers for a specific backdoor key and if found will output the result of the command in the variable `HTTP_X_CMD.`

BadPatch uses HTTP for C2.

RATANKBA uses HTTP/HTTPS for command and control communication.

A SUGARDUMP variant has used HTTP for C2.

XLoader uses HTTP and HTTPS for command and control communication.

ABK has the ability to use HTTP in communications with C2.

Final1stspy uses HTTP for C2.

Kapeka utilizes HTTP for command and control.

Zebrocy uses HTTP for C2.

Pandora can communicate over HTTP.

SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.

OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.

Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.

SampleCheck5000 can use the Exchange Web Services API for C2 communication.

SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.

EvilBunny has executed C2 commands directly via HTTP.

ServHelper uses HTTP for C2.

REvil has used HTTP and HTTPS in communication with C2.