Procedure examples

EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.

APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.

FIN6 has used Pastebin and Google Storage to host content for their operations.

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.

TeamTNT has leveraged iplogger.org to send collected data back to C2.

Mustang Panda has used DropBox URLs to deliver variants of PlugX. Mustang Panda has also used Google Drive to host malicious downloads.

Rocke has used Pastebin, Gitee, and GitLab for Command and Control.

Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.

RedCurl has used web services to download malicious files.

LazyScripter has used GitHub to host its payloads to operate spam campaigns.

APT42 has used various links, such as links with typo-squatted domains, links to Dropbox files and links to fake Google sites, in spearphishing operations.

Fox Kitten has used Amazon Web Services to host C2.

Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.

VOID MANTICORE has utilized Telegram API for C2.

FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.