Procedure examples

APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.

Valak has used HTTP in communications with C2.

Samurai can use a .NET HTTPListener class to receive and handle HTTP POST requests.

PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.

Milan can use HTTPS for communication with C2.

OSX_OCEANLOTUS.D can also use use HTTP POST and GET requests to send and receive C2 information.

OilBooster can send HTTP `GET`, `POST`, `PUT`, and `DELETE` requests to the Microsoft Graph API over port 443 for C2 communication.

OnionDuke uses HTTP and HTTPS for C2.

Taidoor has used HTTP GET and POST requests for C2.

SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.

Cyclops Blink can download files via HTTP and HTTPS.

Seasalt uses HTTP for C2 communications.

PLEAD has used HTTP for communications with command and control (C2) servers.

Raccoon Stealer uses HTTP, and particularly HTTP POST requests, for command and control actions.

IPsec Helper connects to command and control servers via HTTP POST requests based on parameters hard-coded into the malware.

Daserf uses HTTP for C2.

GoldFinder has used HTTP for C2.

Carbon can use HTTP in C2 communications.

Cardinal RAT is downloaded using HTTP over port 443.

DanBot can use HTTP in C2 communication.

GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.

Gold Dragon uses HTTP for communication to the control servers.

RGDoor uses HTTP for C2 communications.

Ramsay has used HTTP for C2.

Neo-reGeorg can use customized HTTP headers.

AshTag can use HTTP to send and receive data from C2.

Carberp has connected to C2 servers via HTTP.

FRAMESTING can retrieve C2 commands from values stored in the `DSID` cookie from the current HTTP request or from decompressed zlib data within the request's `POST` data.

TrailBlazer has used HTTP requests for C2.

MOPSLED can communicate to C2 nodes over HTTP.

More_eggs uses HTTPS for C2.

OutSteel has used HTTP for C2 communications.

BackConfig has the ability to use HTTPS for C2 communiations.

PowGoop can send HTTP GET requests to malicious servers.

BoomBox has used HTTP POST requests for C2.

LAMEHUG can use HTTP POST requests to exfiltrate data from compromised hosts to C2.

Mango can retrieve C2 commands sent in HTTP responses.

WIREFIRE can respond to specific HTTP `POST` requests to `/api/v1/cav/client/visits`.

GrimAgent has the ability to use HTTP for C2 communications.

LookBack’s C2 proxy tool sends data to a C2 server over HTTP.

STEADYPULSE can parse web requests made to a targeted server to determine the next stage of execution.

YAHOYAH uses HTTP for C2.

Lokibot has used HTTP for C2 communications.

One variant of CloudDuke uses HTTP and HTTPS for C2.

Egregor has communicated with its C2 servers via HTTPS protocol.

PoetRAT has used HTTP and HTTPs for C2 communications.

Various implementations of CHOPSTICK communicate with C2 over HTTP.

StealBit can use HTTP to exfiltrate files to actor-controlled infrastructure.

FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.

ZxShell has used HTTP for C2 connections.