Procedure examples

An APT3 downloader establishes SOCKS5 connections for its initial C2.

HAFNIUM has used TCP for C2.

FIN6 has used Metasploit Bind and Reverse TCP stagers.

Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.

Mustang Panda has utilized TCP-based reverse shells using cmd.exe.

UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.

BITTER has used TCP for C2 communications.

BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets. Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.

ToddyCat has used a passive backdoor that receives commands with UDP packets.

Metador has used TCP for C2.

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.