Procedure examples

Orz has used Technet and Pastebin web pages for command and control.

yty communicates to the C2 server by retrieving a Google Doc.

DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.

LOWBALL uses the Dropbox cloud storage service for command and control.

KARAE can use public cloud-based storage providers for command and control.

SLOWDRIFT uses cloud based services for C2.

ODAgent can use the Microsoft Graph API to access an attacker-controlled OneDrive account and retrieve payloads and backdoor commands.

RegDuke can use Dropbox as its C2 server.

TRANSLATEXT has used a Github repository for C2.

UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.

Kazuar has used compromised WordPress blogs as C2 servers.

POORAIM has used AOL Instant Messenger for C2.

The CALENDAR malware communicates through the use of events in Google Calendar.

ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.

Clambling can use Dropbox to download malicious payloads, send commands, and receive information.

CreepyDrive can use OneDrive for C2.

Sagerunex has used virtual private servers (VPS) for command and control traffic as well as third-party cloud services in more recent variants.

BLUELIGHT can use different cloud providers for its C2.

RogueRobin has used Google Drive as a Command and Control channel.

BoxCaon has used DropBox for C2 communications.

Crutch can use Dropbox to receive commands and upload stolen data.

Grandoreiro can utilize web services including Google sites to send and receive C2 data.

OilCheck can use a REST-based Microsoft Graph API to access draft messages in a shared Microsoft Office 365 Outlook email account used for C2 communication.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve C2 commands and payloads placed in Draft messages.

OilBooster uses the Microsoft Graph API to connect to an actor-controlled OneDrive account to download and execute files and shell commands, and to create directories to share exfiltrated data.

Revenge RAT used blogpost.com as its primary command and control server during a campaign.

LAMEHUG has used the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM to generate one-line Windows commands for the collection of system information and documents in specific folders on compromised hosts. LAMEHUG subsequently executed the returned commands and exfiltrated the collected files and information to adversary-controlled C2 servers.

One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.

RIFLESPINE can retrieve C2 commands from an encrypted file on Google Drive then upload the results of command execution back to Google Drive.

BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.

ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.

PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use.

CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.

BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.

GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.

Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.

Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.

Empire can use Dropbox and GitHub for C2.