Procedure examples

RIFLESPINE can use HTTP `GET` and `PUT` to upload and download files.

SLIGHTPULSE has the ability to process HTTP GET requests as a normal web server and to insert logic that will read or write files or execute commands in response to HTTP POST requests.

CreepySnail can use HTTP for C2.

Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.

Troll Stealer uses HTTP to communicate to command and control infrastructure.

Kinsing has communicated with C2 over HTTP.

njRAT has used HTTP for C2 communications.

Maze has communicated to hard-coded IP addresses via HTTP.

ComRAT has used HTTP requests for command and control.

ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.

ANDROMEDA has the ability to make GET requests to download files from C2.

Manjusaka has used HTTP for command and control communication.

IceApple can use HTTP GET to request and pull information from C2.

Shai-Hulud has utilized curl to install Bun over HTTPS.

metaMain can use HTTP for C2 communications.

SideTwist has used HTTP GET and POST requests over port 443 for C2.

MechaFlounder has the ability to use HTTP in communication with C2.

Psylo uses HTTPS for C2.

HTTPBrowser has used HTTP and HTTPS for command and control.

Mis-Type network traffic can communicate over HTTP.

LunarWeb can use `POST` to send victim identification to C2 and `GET` to retrieve commands.

Dipsind uses HTTP for C2.

Octopus has used HTTP GET and POST requests for C2 communications.

AppleJeus has sent data to its C2 server via POST requests.

SoreFang can use HTTP in C2 communications.

STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.

Industroyer’s main backdoor connected to a remote C2 server using HTTPS.

DownPaper communicates to its C2 server over HTTP.

CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.

Variants of Kevin can communicate with C2 over HTTP.

Agent Tesla has used HTTP for C2 communications.

httpclient uses HTTP for command and control.

POWERTON has used HTTP/HTTPS for C2 traffic.

BADNEWS establishes a backdoor over HTTP.

Goopy has the ability to communicate with its C2 over HTTP.

ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.

Remexi uses BITSAdmin to communicate with the C2 server over HTTP.

QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.

Gelsemium can use HTTP/S in C2 communications.

Helminth can use HTTP for C2.

Dridex has used POST requests and HTTPS for C2 communications.

BBK has the ability to use HTTP in communications with C2.

The Komplex C2 channel uses HTTP POST requests.

Comnie uses HTTP for C2 communication.

Vasport creates a backdoor by making a connection using a HTTP POST.

MacSpy uses HTTP for command and control.

BACKSPACE uses HTTP as a transport to communicate with its command server.

UPPERCUT has used HTTP for C2, including sending error codes in cookie headers.

ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.

SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.