Sub-technique of T1102 Web Service.View on attack.mitre.org
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Rules on DetectionCode tagged with T1102.002.
| Rule | Level | Log source |
|---|---|---|
| Github Self-Hosted Runner Execution | medium | windows / process_creation |
| Telegram API Access | medium | NULL / proxy |
| Telegram Bot API Request | medium | NULL / dns |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Potential Telegram API Request Via CommandLine | Anomaly | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Windows DNS Query Request by Telegram Bot API | Anomaly | NULL | Sysmon EventID 22 |
| Used by | Procedure example |
|---|---|
| GroupAPT12 | APT12 has used blogs and WordPress for C2 infrastructure. |
| GroupAPT28 | APT28 has used Google Drive for C2. |
| GroupAPT37 | APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2. |
| GroupAPT39 | APT39 has communicated with C2 through files uploaded to and downloaded from DropBox. |
| GroupCarbanak | Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2. |
| GroupFIN7 | FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2. |
| GroupGamaredon Group | Gamaredon Group has used several ways to try to resolve the C2 server, including: public third-party websites, an adversary-operated Telegraph channel, the ngrok utility and the TXT record of a hardcoded C2 domain. |
| GroupHEXANE | HEXANE has used cloud services, including OneDrive, for C2. |
| Used by | Procedure example |
|---|---|
| MalwareBADNEWS | BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs. |
| MalwareBLACKCOFFEE | BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github. |
| MalwareBLUELIGHT | BLUELIGHT can use different cloud providers for its C2. |
| MalwareBoxCaon | BoxCaon has used DropBox for C2 communications. |
| MalwareCALENDAR | The CALENDAR malware communicates through the use of events in Google Calendar. |
| MalwareClambling | Clambling can use Dropbox to download malicious payloads, send commands, and receive information. |
| MalwareCloudDuke | One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators. |
| MalwareComnie | Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server. |
| Used by | Procedure example |
|---|---|
| Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries had communicated to both Dropbox and Pastebin. |
| CampaignOperation Ghost | For Operation Ghost, APT29 used social media platforms to hide communications to C2 servers. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
