Non-Application Layer Protocol

During the 2022 Ukraine Electric Power Attack, Sandworm Team proxied C2 communications within a TLS-based tunnel.^[5]

Anchor has used ICMP in C2 communications.^[6]

An APT3 downloader establishes SOCKS5 connections for its initial C2.^[7]

Aria-body has used TCP in C2 communications.^[8]

AuTo Stealer can use TCP to communicate with command and control servers.^[9]

BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.^[10]

Bandook has a command built in to use a raw TCP socket.^[11]

Bisonal has used raw sockets for network communication.^[12]

BITTER has used TCP for C2 communications.^[13]

Brute Ratel C4 has the ability to use TCP for external C2.^[14]

BUBBLEWRAP can communicate using SOCKS.^[15]

During C0021, the threat actors used TCP for some C2 communications.^[16]

Carbon uses TCP and UDP for C2.^[17]

cd00r can monitor incoming C2 communications sent over TCP to the compromised host.^[18][19]

Clambling has the ability to use TCP and UDP for communication.^[20]

COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.^[21]

Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.^[22][23]

Crimson uses a custom TCP protocol for C2.^[24][25]

Cryptoistic can use TCP in communications with C2.^[26]

Cuckoo Stealer can use sockets for communications to its C2 server.^[27]

During Cutting Edge, threat actors used the Unix socket and a reverse TCP shell for C2 communications.^[28]

Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.^[29]

Drovorub can use TCP to communicate between its agent and client modules.^[30]

Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets.^[31] Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.^[32]

Some variants of FakeM use SSL to communicate with C2 servers.^[33]

FIN6 has used Metasploit Bind and Reverse TCP stagers.^[34]

FRP can communicate over TCP, TCP stream multiplexing, KERN Communications Protocol (KCP), QUIC, and UDP.^[35]

FunnyDream can communicate with C2 over TCP and UDP.^[36]

Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.^[37]

Gelsemium has the ability to use TCP and UDP in C2 communications.^[38]

gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.^[39]

HAFNIUM has used TCP for C2.^[40]

HiddenWasp communicates with a simple network protocol over TCP.^[41]

InvisibleFerret has established a connection with the C2 server over TCP traffic.^[42] InvisibleFerret has also created a TCP reverse shell communicating via a socket connection over ports 1245, 80, 2245, 3001, and 5000.^[43]

InvisiMole has used TCP to download additional modules.^[44]

J-magic can monitor incoming C2 communications sent over TCP to the compromised host.^[19]

KEYPLUG can use TCP and KCP (KERN Communications Protocol) over UDP for C2 communication.^[45]

KV Botnet Activity command and control traffic uses a non-standard, likely custom protocol for communication.^[46]

LITTLELAMB.WOOLTEA can function as a stand-alone backdoor communicating over the /tmp/clientsDownload.sock socket.^[28]

Lizar has used a raw TCP connection to communicate with the C2 server.^[47]

LookBack uses a custom binary protocol over sockets for C2 communications.^[48]

LunarMail can ping a specific C2 URL with the ID of a victim machine in the subdomain.^[49]

MacMa has used a custom JSON-based protocol for its C&C communications.^[50]

Mafalda can use raw TCP for C2.^[51]

Metador has used TCP for C2.^[51]

metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.^[51][52]

Metamorfo has used raw TCP for C2.^[53]

Mis-Type network traffic can communicate over a raw socket.^[54]

Misdat network traffic communicates over a raw socket.^[54]

MoonWind completes network communication via raw sockets.^[55]

MOPSLED can use a custom binary protocol over TCP for C2 communication.^[56]

Mustang Panda has utilized TCP-based reverse shells using cmd.exe.^[57]

Mythic supports WebSocket and TCP-based C2 profiles.^[58]

Nebulae can use TCP in C2 communications.^[59]

Neo-reGeorg can create multiple TCP connections for a single session.^[60]

If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.^[61]

NETWIRE can use TCP in C2 communications.^[62][63]

Ninja can forward TCP packets between the C2 and a remote host.^[64][65]

During Operation Wocao, threat actors used a custom protocol for command and control.^[66]

OSX_OCEANLOTUS.D has used a custom binary protocol over port 443 for C2 traffic.^[67]

Pay2Key has sent its public key to the C2 server over TCP.^[68]

The Penquin C2 mechanism is based on TCP and UDP packets.^[69][70]

PHOREAL communicates via ICMP for C2.^[71]

PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.^[72]

The PipeMon communication module can use a custom protocol based on TLS over TCP.^[73]

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.^[74]

PlugX can be configured to use raw TCP or UDP for command and control.^[75][76]

QakBot has the ability use TCP to send or receive C2 packets.^[77]

QuasarRAT can use TCP for C2 communication.^[78]

QUIETEXIT can establish a TCP connection as part of its initial connection to the C2.^[79]

RainyDay can use TCP in C2 communications.^[59]

RARSTONE uses SSL to encrypt its communication with its C2 server.^[80]

RCSession has the ability to use TCP and UDP in C2 communications.^[20][81]

Some Reaver variants use raw TCP for C2.^[82]

Mustang Panda communicated over TCP 5000 from adversary administrative servers to adversary command and control nodes during RedDelta Modified PlugX Infection Chain Operations.^[83]

During RedPenguin, UNC3886 leveraged malware that used UDP and TCP sockets for C2.^[84][85][86]

reGeorg can tunnel TCP sessions into targeted networks.^[87]

The Regin malware platform can use ICMP to communicate between infected computers.^[88]

Remsec is capable of using ICMP, TCP, and UDP for C2.^[89][90]

REPTILE can communicate using TLS over raw TCP.^[56][91]

RotaJakiro uses a custom binary protocol using a type, length, value format over TCP.^[92]

Royal establishes a TCP socket for C2 communication using the API WSASocketW.^[93]

Samurai can use a proxy module to forward TCP packets to external hosts.^[64]

Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.^[94]

SDBbot has the ability to communicate with C2 with TCP over port 443.^[95]

ShadowPad has used UDP for C2 communications.^[96]

SnappyTCP spawns a reverse TCP shell following an HTTP-based negotiation.^[97]

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.^[98][99]

Spica can use JSON over WebSockets for C2 communications.^[100]

StarProxy has used TCP for C2 communications to target IPs or domains. StarProxy contained code to support both UDP and TCP connections.^[101]

StealBit can use the Windows Socket networking library to communicate with attacker-controlled endpoints.^[102]

SUGARUSH has used TCP for C2.^[103]

Taidoor can use TCP for C2 communications.^[104]

ToddyCat has used a passive backdoor that receives commands with UDP packets.^[65]

TONESHELL has utilized TCP-based reverse shells.^[105]

TSCookie can use ICMP to receive information on the destination server.^[106]

Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.^[107]

UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.^[4][56][91]

Uroburos can communicate through custom methodologies for UDP, ICMP, and TCP that use distinct sessions to ride over the legitimate protocols.^[108]

Versa Director Zero Day Exploitation used a non-standard TCP session to initialize communication prior to establishing HTTPS command and control.^[109]

WarzoneRAT can communicate with its C2 server via TCP over port 5200.^[110]

WellMail can use TCP for C2 communications.^[111]

WINDSHIELD C2 traffic can communicate via TCP raw sockets.^[71]

Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.^[112]

Winnti for Windows can communicate using custom TCP.^[113]

ZIPLINE can communicate with C2 using a custom binary protocol.^[114]

Periodically investigate ESXi hosts for open VMCI ports. Running the lsof -A command and inspecting results with a type of SOCKET_VMCI will reveal processes that have open VMCI ports.^[115]

Filter network traffic to prevent use of protocols across the network boundary that are unnecessary. If VMCI is not required in ESXi environments, consider restricting guest virtual machines from accessing VMCI services.^[116]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.