Commonly Used Port

A variant of ADVSTORESHELL attempts communication to the C2 server over HTTP on port 443.^[38]

APT18 uses port 80 for C2 communications.^[81][82]

APT19 used TCP port 80 for C2.^[73]

APT28 has used port 443 for C2.^[89]

APT29 has used Port Number 443 for C2.^[87]

APT3 uses commonly used ports (like HTTPS/443) for command and control.^[79]

APT32 has used port 80 for C2 communications.^[31][80]

APT33 has used port 443 for command and control.^[60]

APT37 has used port 8080 for C2.^[78]

AuditCred has used Port Number 443 for C2 communications.^[41]

BADCALL uses port 8000 and 443 for C2.^[5]

BadPatch uses port 26 for C2 communications.^[39]

BBSRAT uses HTTP TCP port 80 and HTTPS TCP port 443 for communications.^[34]

Bisonal uses 443 for C2 communications.^[36]

Briba connects to external C2 infrastructure over port 443.^[35]

Calisto attempted to contact the C2 server over TCP using port 80.^[22]

Carbanak uses Port Numbers 443 and 80 for the C2 server.^[30]

Carbon uses port 80 for C2 communications.^[11]

Cardinal RAT is downloaded using HTTP over port 443.^[14]

Cobalt Strike uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols.^[3]

Comnie uses Port Numbers 80, 8080, 8000, and 443 for communication to the C2 servers.^[46]

Denis uses port 53 for C2 communications.^[31]

Derusbi beacons to destination port 443.^[54]

Dragonfly 2.0 used SMB over ports 445 or 139 for C2. The group also established encrypted connections over port 443.^[85][86]

Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.^[6]

Ebury has used UDP port 53 for C2. ^[62]

ELMER uses HTTP over port 443 for command and control.^[13]

Emotet has used ports 20, 22, 80, 443, 8080, and 8443.^{[56][57][58][59]}

Empire can conduct command and control over commonly used ports like 80 and 443.^[4]

EvilGrab uses port 8080 for C2.^[42]

FELIXROOT uses Port Numbers 443, 8443, and 8080 for C2 communications.^[19][20]

FIN7 has used ports 53, 80, 443, and 8080 for C2.^[84]

FIN8 has tunneled RDP backdoors over port 443.^[72]

FlawedAmmyy has used port 443 for C2.^[63]

FlawedGrace has used port 443 for C2 communications.^[64]

FTP operates over ports 21 and 20.^[2]

Fysbis has used port 80 for C2. ^[70]

gh0st RAT uses port 443 for C2 communications.^[44]

HARDRAIN binds and listens on port 443.^[37]

HAWKBALL has sent HTTP GET requests over port 443 for C2.^[68]

Hi-Zor communicates with its C2 server over port 443.^[23]

HOPLIGHT has connected outbound over TCP port 443. ^[61]

One HTTPBrowser variant connected to its C2 server over port 8080.^[7]

InvisiMole uses port 80 for C2.^[33]

Ixeshe has used TCP port 443 for C2.^[65]

KeyBoy calls back to the C2 server over ports 53, 80, and 443.^[66][67]

KEYMARBLE uses port 443 for C2.^[50]

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes commonly used ports such as 443, 53, 80, 25, and 8080.^[75][76]

Linux Rabbit checks to see if an SSH server is listening on port 22.^[55]

LOWBALL command and control occurs via HTTPS over port 443.^[9]

Machete used TCP port 21 for C2.^[91]

Magic Hound malware has communicated with C2 servers over port 6667 (for IRC) and port 8080.^[71]

MirageFox uses port 80 for C2.^[16]

Mis-Type communicates over common ports such as TCP 80, 443, and 25.^[12]

Misdat network traffic communicates over common ports like 80, 443, or 1433.^[12]

Mivast communicates over port 80 for C2.^[25]

MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.^[32]

Naid connects to external C2 infrastructure over port 443.^[47]

Nidiran communicates with its C2 domain over ports 443 and 8443.^[48]

Night Dragon has used ports 25 and 80 for C2 communications.^[83]

OceanSalt uses Port Number 8080 for C2.^[40]

OilRig has used port 80 to call back to the C2 server. ^[90]

Pasam connects to external C2 infrastructure and opens a backdoor over port 443.^[26]

PlugX has beaconed to its C2 over port 443.^[42][43]

PowerDuke connects over 443 for C2.^[51]

POWERSTATS has used port 80 for C2.^[49]

POWERTON has used port 443 for C2 traffic. ^[60]

Proxysvc uses port 443 for the control server communications.^[10]

RATANKBA uses port 443 for C2.^[21]

RedLeaves uses a specific port of 443 and can also use ports 53 and 80 for C2. One RedLeaves variant uses HTTP over port 443 to connect to its C2 server.^[42][52]

RIPTIDE is a RAT that communicates with HTTP.^[53]

S-Type uses ports 80, 443, and 8080 for C2.^[12]

ServHelper has used port 80 and 443 for C2.^[64]

Shamoon has used TCP port 8080 for C2.^[24]

TEMP.Veles has used port 443 for C2.^[88]

C2 traffic for most Threat Group-3390 tools occurs over Port Numbers 53, 80, and 443.^[77]

TrickBot uses port 443 for C2 communications.^[17][18]

Tropic Trooper can use ports 443 and 53 for C2 communications via malware called TClient.^[74]

TYPEFRAME variants can use ports 443, 8443, and 8080 for communications.^[15]

UBoatRAT uses ports 80 and 443 for C2 communications.^[45]

Some Volgmer variants use ports 8080 and 8000 for C2.^[27][28][29]

Wiarp connects to external C2 infrastructure over the HTTP port.^[8]

ZxShell uses common ports such as 80 and 443 for C2.^[69]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.^[1]

Configure internal and external firewalls to block traffic using common ports that associate to network protocols that may be unnecessary for that particular network segment.