Procedure examples

TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

BLINDINGCAN has used HTTPS over port 443 for command and control.

Ninja can use HTTP for C2 communications.

RCSession can use HTTP in C2 communications.

Spark has used HTTP POST requests to communicate with its C2 server to receive commands.

QuietSieve can use HTTPS in C2 communications.

BRICKSTORM has communicated to hardcoded C2 through WebSockets (WSS) to include domains associated with Cloudflare Workers. BRICKSTORM has also leveraged Gorilla mux library to serve its HTTP API calls.

Amadey has used HTTP for C2 communications.

NICECURL has used HTTPS for C2 communications.

Proxysvc uses HTTP over SSL to communicate commands with the control server.

Torisma can use HTTP and HTTPS for C2 communications.

NOKKI has used HTTP for C2 communications.

Stuxnet uses HTTP to communicate with a command and control server.

IronWind can used HTTP to send information to C2 about the targeted system.

Get2 has the ability to use HTTP to send information collected from an infected host to C2.

POWRUNER can use HTTP for C2 communications.

KOPILUWAK has used HTTP POST requests to send data to C2.

COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.

Smoke Loader uses HTTP for C2.

WindTail has the ability to use HTTP for C2 communications.

reGeorg can use HTTP to tunnel connections in and out of targeted networks.

Emissary uses HTTP or HTTPS for C2.

Exaramel for Linux uses HTTPS for C2 communications.

BUBBLEWRAP can communicate using HTTP or HTTPS.

HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.

TAMECAT has used HTTP for C2 communications.

Ursnif has used HTTPS for C2.

ZLib communicates over HTTP for C2.

RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.

Tsundere Botnet has obtained the WebSocket C2 address by making remote procedure call (RPC) APIs to Ethereum blockchain nodes.

Felismus uses HTTP for C2.

Zeus Panda uses HTTP for C2 communications.

GeminiDuke uses HTTP and HTTPS for command and control.

Havoc can use HTTP/S listeners to establish and maintain C2 communications.

GravityRAT uses HTTP for C2.

InvisibleFerret has used HTTP for C2 communications.

Bankshot uses HTTP for command and control communication.

StrongPity can use HTTP and HTTPS in C2 communications.

xCaon has communicated with the C2 server by sending POST requests over HTTP.

Pony has sent collected information to the C2 via HTTP POST request.

WinMM uses HTTP for C2.

TONESHELL has utilized HTTP for a C2 protocol through HTTP POST. TONESHELL has also utilized HTTPS for C2.

RainyDay can use HTTP in C2 communications.

AppleSeed has the ability to communicate with C2 over HTTP.

LOWBALL command and control occurs via HTTPS over port 443.

NETWIRE has the ability to communicate over HTTP.

TinyTurla can use HTTPS in C2 communications.

BOOKWORM has communicated with its C2 via HTTP POST requests.

The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.

OLDBAIT can use HTTP for C2.