Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.[1] Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
ID | Name | Description |
---|---|---|
G0050 | APT32 |
APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.[2] |
C0040 | APT41 DUST |
APT41 DUST used compromised Google Workspace accounts for command and control.[3] |
S1081 | BADHATCH |
BADHATCH can be utilized to abuse |
S0534 | Bazar | |
S0635 | BoomBox |
BoomBox can download files from Dropbox using a hardcoded access token.[7] |
S1063 | Brute Ratel C4 |
Brute Ratel C4 can use legitimate websites for external C2 channels including Slack, Discord, and MS Teams.[8] |
S1039 | Bumblebee |
Bumblebee has been downloaded to victim's machines from OneDrive.[9] |
C0017 | C0017 |
During C0017, APT41 used the Cloudflare services for C2 communications.[10] |
C0027 | C0027 |
During C0027, Scattered Spider downloaded tools from sites including file.io, GitHub, and paste.ee.[11] |
S0335 | Carbon | |
S0674 | CharmPower |
CharmPower can download additional modules from actor-controlled Amazon S3 buckets.[13] |
S1149 | CHIMNEYSWEEP |
CHIMNEYSWEEP has the ability to use use Telegram channels to return a list of commands to be executed, to download additional payloads, or to create a reverse shell.[14] |
S1066 | DarkTortilla |
DarkTortilla can retrieve its primary payload from public sites such as Pastebin and Textbin.[15] |
S0600 | Doki |
Doki has used the dogechain.info API to generate a C2 address.[16] |
S0547 | DropBook |
DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.[17][18] |
G1011 | EXOTIC LILY |
EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.[19] |
G0037 | FIN6 |
FIN6 has used Pastebin and Google Storage to host content for their operations.[20] |
G0061 | FIN8 |
FIN8 has used |
G0117 | Fox Kitten |
Fox Kitten has used Amazon Web Services to host C2.[22] |
G0047 | Gamaredon Group |
Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.[23] |
S0561 | GuLoader |
GuLoader has the ability to download malware from Google Drive.[24] |
S0601 | Hildegard | |
G0100 | Inception |
Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.[26][27] |
S1160 | Latrodectus |
Latrodectus has used Google Firebase to download malicious installation scripts.[28] |
G0140 | LazyScripter |
LazyScripter has used GitHub to host its payloads to operate spam campaigns.[29] |
G0129 | Mustang Panda |
Mustang Panda has used DropBox URLs to deliver variants of PlugX.[30] |
S0198 | NETWIRE |
NETWIRE has used web services including Paste.ee to host payloads.[31] |
S0508 | ngrok |
ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.[32] |
S1147 | Nightdoor |
Nightdoor can utilize Microsoft OneDrive or Google Drive for command and control purposes.[33][34] |
C0005 | Operation Spalax |
During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.[35] |
S1130 | Raspberry Robin |
Raspberry Robin second stage payloads can be hosted as RAR files, containing a malicious EXE and DLL, on Discord servers.[36] |
G1039 | RedCurl |
RedCurl has used web services to download malicious files.[37][38] |
G0106 | Rocke |
Rocke has used Pastebin, Gitee, and GitLab for Command and Control.[39][40] |
S0546 | SharpStage |
SharpStage has used a legitimate web service for evading detection.[17] |
S0589 | Sibot |
Sibot has used a legitimate compromised website to download DLLs to the victim's machine.[41] |
S0649 | SMOKEDHAM |
SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.[42] |
S1086 | Snip3 |
Snip3 can download additional payloads from web services including Pastebin and top4top.[43] |
S1124 | SocGholish |
SocGholish has used Amazon Web Services to host second-stage servers.[44] |
G0139 | TeamTNT |
TeamTNT has leveraged iplogger.org to send collected data back to C2.[45][46] |
G0010 | Turla |
Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.[12][47] |
S0689 | WhisperGate |
WhisperGate can download additional payloads hosted on a Discord channel.[48][49][50][51][52] |
ID | Mitigation | Description |
---|---|---|
M1031 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. |
M1021 | Restrict Web-Based Content |
Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services. |
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that are sent or received by untrusted hosts. |
Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |
||
Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. |