Procedure examples

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.

BlackByte collected victim device information then transmitted this via HTTP POST to command and control infrastructure.

Kimsuky has used HTTP GET and POST requests for C2.

APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.

APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.

HAFNIUM has used open-source C2 frameworks, including Covenant.

MuddyWater has used HTTP for C2 communications.

RedEcho network activity is associated with SSL traffic via TCP 443 and proxied HTTP traffic over non-standard ports.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.

APT18 uses HTTP for C2 communications.

Sidewinder has used HTTP in C2 communications.

Mustang Panda has communicated with its C2 via HTTP POST requests.

Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.

APT39 has used HTTP in communications with C2.

APT37 uses HTTPS to conceal C2 communications.

OilRig has used HTTP for C2.

Higaisa used HTTP and HTTPS to send data back to its C2 server.

Tropic Trooper has used HTTP in communication with the C2.

Orangeworm has used HTTP for C2.

Sea Turtle connected over TCP using HTTP to establish command and control channels.

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.

Confucius has used HTTP for C2 communications.

Winter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.

SilverTerrier uses HTTP for C2 communications.

Turla has used HTTP and HTTPS for C2 communications.

TA505 has used HTTP to communicate with C2 nodes.

BITTER has used HTTP POST requests for C2.

RedCurl has used HTTP, HTTPS and Webdav protocls for C2 communications.

Stealth Falcon malware communicates with its C2 server via HTTPS.

Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.

Chimera has used HTTPS for C2 communications.

Medusa Group has communicated through reverse or bind shells over port 443 (HTTPS).

BRONZE BUTLER malware has used HTTP for C2.

TA551 has used HTTP for C2 communications.

Windshift has used tools that communicate with C2 over HTTP.

LuminousMoth has used HTTP for C2.

Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.

Metador has used HTTP for C2.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

Lazarus Group has conducted C2 over HTTP and HTTPS.

FIN4 has used HTTP POST requests to transmit data.

Cobalt Group has used HTTPS for C2.

Wizard Spider has used HTTP for network communications.

Moonstone Sleet used curl to connect to adversary-controlled infrastructure and retrieve additional payloads.

Inception has used HTTP, HTTPS, and WebDav in network communications.

VOID MANTICORE has utilized HTTPS for communication to C2 domains.

Daggerfly uses HTTP for command and control communication.

Rancor has used HTTP for C2.