Procedure examples

Tsundere Botnet has obtained the C2 address from Ethereum blockchain nodes.

PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.

TRANSLATEXT has used a dead drop resolver to retrieve configurations and commands from a public blog site.

Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.

Javali can read C2 information from Google Documents and YouTube.

PlugX uses Pastebin to store C2 addresses.

Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.

The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums.

CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.

GlassWorm has leveraged blockchain-based C2 infrastructure to include Solana blockchain that contains additional C2 details within the memo field. GlassWorm has also leveraged Google Calendar to host encoded data.

Metamorfo has used YouTube to store and hide C&C server domains.

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.

Grandoreiro can obtain C2 information from Google Docs.

MOPSLED has the ability to retrieve a C2 address from a dead drop URL.

BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.

BADNEWS collects C2 information via a dead drop resolver.

Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.

Mini Shai-Hulud has leveraged GitHub commit-search API to recover fallback C2 domains stored in auto-created public Github repositories.

CanisterWorm can periodically poll a decentralized Internet Computer Protocol (ICP) canister to retrieve a dynamic URL for payload delivery.