Procedure examples

Uroburos can use custom communications protocols that ride over SMTP.

NightClub can use emails for C2 communications.

BadPatch uses SMTP for C2.

A SUGARDUMP variant used SMTP for C2.

Zebrocy uses SMTP and POP3 for C2.

LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.

ComRAT can use email attachments for command and control.

JPIN can send email over SMTP.

Agent Tesla has used SMTP for C2 communications.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

BRICKSTORM has used DNS over HTTPS to resolve C2 infrastructure and obscure DNS traffic from inspection.

POWRUNER can use DNS for C2 communications.

POWERSOURCE uses DNS TXT records for C2.

Matryoshka uses DNS for C2.

SystemBC has used DNS servers to resolve .bit domains to C2 infrastructure.

WellMess has the ability to use DNS tunneling for C2 communications.

SombRAT can communicate over DNS with the C2 server.

InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.

RDAT has used DNS to communicate with the C2.

TEXTMATE uses DNS TXT records for C2.

Green Lambert can use DNS for C2 communications.

Variants of Anchor can use DNS tunneling to communicate with C2.

PlugX can be configured to use DNS for command and control.

Remsec is capable of using DNS for C2.

DarkGate can cloak command and control traffic in DNS records from legitimate services to avoid reputation-based detection techniques.

NanHaiShu uses DNS for the C2 communications.

Mori can use DNS tunneling to communicate with C2.

QUADAGENT uses DNS for C2 communications.

Uroburos has encoded outbound C2 communications in DNS requests consisting of character strings made to resemble standard domain names. The actual information transmitted by Uroburos is contained in the part of the character string prior to the first ‘.’ character.

DnsSystem can direct queries to custom DNS servers and return C2 commands using TXT records.

NightClub can use a DNS tunneling plugin to exfiltrate data by adding it to the subdomain portion of a DNS request.

Shark can use DNS in C2 communications.

SOUNDBITE communicates via DNS for C2.

Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.

SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.

Cobian RAT uses DNS for C2.

Milan has the ability to use DNS for C2 communications.

DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.

Pisloader uses DNS as its C2 protocol.

SysUpdate has used DNS TXT requests as for its C2 communication.

BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.

Ebury has used DNS requests over UDP port 53 for C2.

Heyoka Backdoor can use DNS tunneling for C2 communications.

HTTPBrowser has used DNS for command and control.

Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information.

Goopy has the ability to communicate with its C2 over DNS.

ShadowPad has used DNS tunneling for C2 communications.

Gelsemium has the ability to use DNS in communication with C2.