Procedure examples

ELMER uses HTTP for command and control.

PolyglotDuke has has used HTTP GET requests in C2 communications.

HexEval Loader has used HTTP and HTTPS POST requests to communicate with C2.

AuTo Stealer can use HTTP to communicate with its C2 servers.

ShrinkLocker uses HTTP POST requests to communicate victim information back to the threat actor.

FlawedAmmyy has used HTTP for C2.

Cuckoo Stealer can use the curl API for C2 communications.

GuLoader can use HTTP to retrieve additional binaries.

InvisiMole uses HTTP for C2 communications.

P.A.S. Webshell can issue commands via HTTP POST.

WhisperGate can make an HTTPS connection to download additional files.

ZeroT has used HTTP for C2.

Keydnap uses HTTPS for command and control.

RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.

Okrum uses HTTP for communication with its C2.

TRANSLATEXT has used HTTP to communicate with the C2 server.

The Regin malware platform supports many standard protocols, including HTTP and HTTPS.

Line Dancer uses HTTP POST requests to interact with compromised devices.

Neoichor can use HTTP for C2 communications.

Raspberry Robin uses outbound HTTP requests containing victim information for retrieving second stage payloads. Variants of Raspberry Robin can download archive files (such as 7-Zip files) via the victim web browser for second stage execution.

Diavol has used HTTP GET and POST requests for C2.

Doki has communicated with C2 over HTTPS.

RustyWater has used the Rust request library for HTTP C2 communication.

IcedID has used HTTPS in communications with C2.

VERMIN uses HTTP for C2 communications.

UBoatRAT has used HTTP for C2 communications.

HTTPTroy has used HTTP POST requests to communicate with C2.

MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.

PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.

Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.

DarkComet can use HTTP for C2 communications.

NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.

CHIMNEYSWEEP can send `HTTP GET` requests to  C2.

FatDuke can be controlled via a custom C2 protocol over HTTP.

BlackEnergy communicates with its C2 server over HTTP.

DRATzarus can use HTTP or HTTPS for C2 communications.

Rising Sun has used HTTP and HTTPS for command and control.

ShimRat communicated over HTTP and HTTPS with C2 servers.

Flagpro can communicate with its C2 using HTTP.

Hi-Zor communicates with its C2 server over HTTPS.

China Chopper's server component executes code sent via HTTP POST commands.

SnappyTCP connects to the command and control server via a TCP socket using HTTP.

LightSpy's C2 communication is performed over WebSockets using the open source library SocketRocket with functionality such as, heartbeat, receiving commands, and updating command status.

PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.

GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.

LIGHTWIRE can use HTTP for C2 communications.

MiniDuke uses HTTP and HTTPS for command and control.

HyperBro has used HTTPS for C2 communications.

Anchor has used HTTP and HTTPS in C2 communications.

Line Runner utilizes an HTTP-based Lua backdoor on victim machines.