Procedure examples

cd00r can monitor incoming C2 communications sent over TCP to the compromised host.

Ninja can forward TCP packets between the C2 and a remote host.

RCSession has the ability to use TCP and UDP in C2 communications.

RotaJakiro uses a custom binary protocol using a type, length, value format over TCP.

COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.

Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.

Misdat network traffic communicates over a raw socket.

reGeorg can tunnel TCP sessions into targeted networks.

BUBBLEWRAP can communicate using SOCKS.

LITTLELAMB.WOOLTEA can function as a stand-alone backdoor communicating over the `/tmp/clientsDownload.sock` socket.

InvisibleFerret has established a connection with the C2 server over TCP traffic. InvisibleFerret has also created a TCP reverse shell communicating via a socket connection over ports 1245, 80, 2245, 3001, and 5000.

Nebulae can use TCP in C2 communications.

TONESHELL has utilized TCP-based reverse shells.

RainyDay can use TCP in C2 communications.

NETWIRE can use TCP in C2 communications.

J-magic can monitor incoming C2 communications sent over TCP to the compromised host.

Aria-body has used TCP in C2 communications.

Crimson uses a custom TCP protocol for C2.

SystemBC has used raw TCP on non-standard ports, such as 4044, for C2 communications and for HTTP communications, which include downloading binaries.

PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.

Mafalda can use raw TCP for C2.

Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.

AuTo Stealer can use TCP to communicate with command and control servers.

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.

SUGARUSH has used TCP for C2.

Cuckoo Stealer can use sockets for communications to its C2 server.

InvisiMole has used TCP to download additional modules.

QUIETEXIT can establish a TCP connection as part of its initial connection to the C2.

The Regin malware platform can use ICMP to communicate between infected computers.

REPTILE can communicate using TLS over raw TCP.

If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.

SnappyTCP spawns a reverse TCP shell following an HTTP-based negotiation.

Anchor has used ICMP in C2 communications.

PlugX can be configured to use raw TCP or UDP for command and control.

Some Reaver variants use raw TCP for C2.

Bisonal has used raw sockets for network communication.

Remsec is capable of using ICMP, TCP, and UDP for C2.

KEYPLUG can use TCP and KCP (KERN Communications Protocol) over UDP for C2 communication.

Clambling has the ability to use TCP and UDP for communication.

TSCookie can use ICMP to receive information on the destination server.

Pay2Key has sent its public key to the C2 server over TCP.

Royal establishes a TCP socket for C2 communication using the API `WSASocketW`.

Uroburos can communicate through custom methodologies for UDP, ICMP, and TCP that use distinct sessions to ride over the legitimate protocols.

Metamorfo has used raw TCP for C2.

Spica can use JSON over WebSockets for C2 communications.

Bandook has a command built in to use a raw TCP socket.

The PipeMon communication module can use a custom protocol based on TLS over TCP.

Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.

gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.

RARSTONE uses SSL to encrypt its communication with its C2 server.