Procedure examples

Volt Typhoon has employed Ping to check network connectivity.

HAFNIUM has checked for network connectivity from a compromised host using `ping`, including attempts to contact `google[.]com`.

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`. Gamaredon Group has searched the ping records to obtain the C2 address and has used ping to search for the C2’s status.

TA2541 has run scripts to check internet connectivity from compromised hosts.

Turla has used tracert to check internet connectivity.

Lotus Blossom has performed checks to determine if a victim machine is able to access the Internet.

APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.

HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.

Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.

FIN13 has used `Ping` and `tracert` for network reconnaissance efforts.