System Network Configuration Discovery: Internet Connection Discovery

APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.^[1]

DarkTortilla can check for internet connectivity by issuing HTTP GET requests.^[2]

FIN13 has used Ping and tracert for network reconnaissance efforts.^[3]

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.^[4]

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as CSIDL_SYSTEM\cmd.exe /c ping -n 1.^[5] Gamaredon Group has searched the ping records to obtain the C2 address and has used ping to search for the C2’s status.^[6]

GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.^[7]

HAFNIUM has checked for network connectivity from a compromised host using ping, including attempts to contact google[.]com.^[8]

The Havoc demon can check for a connection to the C2 server from the target machine.^[9]

HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.^[10]

Lotus Blossom has performed checks to determine if a victim machine is able to access the Internet.^[11]

Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.^[12]

More_eggs has used HTTP GET requests to check internet connectivity.^[13]

Neoichor can check for Internet connectivity by contacting bing[.]com with the request format bing[.]com?id=<GetTickCount>.^[14]

NKAbuse utilizes external services such as ifconfig.me to identify the victim machine's IP address.^[15]

During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.^[16]

PUBLOAD has identified internet connectivity details through commands such as tracert -h 5 -4 google.com and curl http://myip.ipip.net.^[17]

QakBot can measure the download speed on a targeted host.^[18]

QuietSieve can check C2 connectivity with a ping to 8.8.8.8 (Google public DNS).^[19]

Rising Sun can test a connection to a specified network IP address over a specified port number.^[20]

During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.^[7]

SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.^[21]

SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.^[22]

TA2541 has run scripts to check internet connectivity from compromised hosts. ^[23]

Turla has used tracert to check internet connectivity.^[24]

Volt Typhoon has employed Ping to check network connectivity.^[25]

Woody RAT can make Ping GET HTTP requests to its C2 server at regular intervals for network connectivity checks.^[26]