Procedure examples

JumbledPath can communicate over a unique series of connections to send and retrieve data from exploited devices.

Snip3 can download and execute additional payloads and modules over separate communication channels.

After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.

Latrodectus has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.

Individual Uroburos implants can use multiple communication channels based on one of four available modes of operation.

The Bazar loader is used to download and execute the Bazar backdoor.

Valak can download additional modules and malware capable of using separate C2 channels.

BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.

LunarWeb can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.

BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.