Non-Standard Port

APT-C-36 has used port 4050 for C2 communications.^[4]

An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.^[5]

APT33 has used HTTP over TCP ports 808 and 880 for command and control.^[1]

BADCALL communicates on ports 443 and 8000 with a FakeTLS method.^[6]

Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.^[7]

BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.^[8]

During C0018, the threat actors opened a variety of ports, including ports 28035, 32467, 41578, and 46892, to establish RDP connections.^[9]

During the C0032 campaign, TEMP.Veles used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.^[10]

Covenant listeners and controllers can be configured to use non-standard ports.^[11]

Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.^[12]

DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.^[13]

Derusbi has used unencrypted HTTP on port 443 for C2.^[14]

Ember Bear has used various non-standard ports for C2 communication.^[15]

Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.^[16][17]

FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.^[18]

GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.^[19]

GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.^[20]

HARDRAIN binds and listens on port 443 with a FakeTLS method.^[21]

HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.^[22]

KV Botnet Activity generates a random port number greater than 30,000 to serve as the listener for subsequent command and control activity.^[23]

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.^[24][25]

MacMa has used TCP port 5633 for C2 Communication.^[26]

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.^[27][28]

Metamorfo has communicated with hosts over raw TCP on port 9999.^[29]

MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.^[30]

njRAT has used port 1177 for HTTP C2 communications.^[31]

During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.^[32]

OSX_OCEANLOTUS.D has used a custom binary protocol over TCP port 443 for C2.^[33]

Pikabot uses non-standard ports, such as 2967, 2223, and others, for HTTPS command and control communication.^[34]

PingPull can use HTTPS over port 8080 for C2.^[35]

PoetRAT used TLS to encrypt communications over port 143^[36]

QuasarRAT can use port 4782 on the compromised host for TCP callbacks.^[37]

Raspberry Robin will communicate via HTTP over port 8080 for command and control traffic.^[38]

RedLeaves can use HTTP over non-standard ports, such as 995, for C2.^[39]

Rocke's miner connects to a C2 server using port 51640.^[40]

RotaJakiro uses a custom binary protocol over TCP port 443.^[41]

RTM used Port 44443 for its VNC module.^[42]

Sandworm Team has used port 6789 to accept connections on the group's SSH server.^[43]

Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.^[44]

Silence has used port 444 when sending data about the system from the client to the server.^[45]

StrongPity has used HTTPS over port 1402 in C2 communication.^[46]

SUGARUSH has used port 4585 for a TCP connection to its C2.^[47]

Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.^[48][49][50] Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443. ^[51]

TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.^[52]

WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.^[53][54]

WIRTE has used HTTPS over ports 2083 and 2087 for C2.^[55]

ZxShell can use ports 1985 and 1986 in HTTP/S communication.^[56]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.