{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1095","id":"T1095","name":"Non-Application Layer Protocol","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1095","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8e6d21b1cea11a47db5389637ac0955282bc1766a1f9f63bb40396857b34f49d","description":"Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\n\nICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.\n\nIn ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host’s backdoor, regardless of network segmentation or firewall rules in place.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1095","external_id":"T1095"},{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","description":"Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source_name":"University of Birmingham C2","description":"Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.","url":"https://arxiv.org/pdf/1408.1136"},{"source_name":"Cisco Synful Knock Evolution","description":"Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.","url":"https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"},{"source_name":"Microsoft ICMP","description":"Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics. Retrieved December 1, 2014.","url":"http://support.microsoft.com/KB/170292"},{"source_name":"Cisco Blog Legacy Device Attacks","description":"Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.","url":"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"},{"source_name":"Wikipedia OSI","description":"Wikipedia. (n.d.). List of network protocols (OSI model). Retrieved December 4, 2014.","url":"http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1095","id":"T1095","name":"Non-Application Layer Protocol","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1095","technique_page":"techniques/enterprise/T1095/","page":"detections/enterprise/T1095/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"ede05abc-2c9e-4624-9944-9ff17fdc0bf5","title":"Suspicious DNS Z Flag Bit Set","status":"test","level":"medium","logsource":{"product":"zeek","service":"dns"},"data_path":"data/detection-rules/ede05abc-2c9e-4624-9944-9ff17fdc0bf5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_dns_susp_zbit_flag.yml","author":"@neu5ron, SOC Prime Team, Corelight","kind":"sigma"},{"id":"c5b20776-639a-49bf-94c7-84f912b91c15","title":"Netcat The Powershell Version","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_classic_start"},"data_path":"data/detection-rules/c5b20776-639a-49bf-94c7-84f912b91c15.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_powercat.yml","author":"frack113","kind":"sigma"},{"id":"e31033fc-33f0-4020-9a16-faf9b31cbf08","title":"PUA - Netcat Suspicious Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e31033fc-33f0-4020-9a16-faf9b31cbf08.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_netcat.yml","author":"frack113, Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0457","name":"Detection of Non-Application Layer Protocols for C2","url":"https://attack.mitre.org/detectionstrategies/DET0457","stix_id":"x-mitre-detection-strategy--2cb544af-ef54-4376-9608-b399ad67d3d6","relationship_id":"relationship--b49312bd-f37c-4b0f-a6c8-4ab38f14db65","description":"","analytics":[{"id":"AN1254","name":"Analytic 1254","guidance":"Anomalous use of ICMP or UDP by non-network service processes for data exfiltration or remote control, especially if traffic bypasses proxy infrastructure or shows unusual flow patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1254","platforms":["Windows"],"tuning":[{"field":"ProcessContextAllowList","description":"Processes normally allowed to use ICMP/UDP (e.g., ping.exe, DNS resolver)."},{"field":"ByteTransferAnomalyThreshold","description":"Suspicion if client sends much more data than it receives (e.g., >90%)."},{"field":"ProtocolUsageBaseline","description":"Baseline which protocols are normal per host or segment (ICMP, UDP, etc.)."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1254","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1254","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"ICMP/UDP traffic (Wireshark, Suricata, Zeek)","platforms":["Windows"],"analytic_id":"AN1254","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1254","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1255","name":"Analytic 1255","guidance":"ICMP or raw socket traffic generated by user-mode processes like bash, Python, or nc, typically using `ping`, `hping3`, or crafted packets via libpcap or scapy.","url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1255","platforms":["Linux"],"tuning":[{"field":"RawSocketExecutionPath","description":"Uncommon programs using raw sockets (e.g., netcat, Python, nmap)."},{"field":"TimeWindow","description":"Tunable window for correlating execution with network events (e.g., 2m)."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"sendto/connect","platforms":["Linux"],"analytic_id":"AN1255","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1255","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"icmp.log, weird.log","platforms":["Linux"],"analytic_id":"AN1255","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1255","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1256","name":"Analytic 1256","guidance":"Unsigned binaries or interpreted scripts initiating non-standard protocols (ICMP, UDP, SOCKS) outside of baseline network behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1256","platforms":["macOS"],"tuning":[{"field":"UnsignedBinaryNetworkUsage","description":"Detection threshold for unsigned or transient binaries making ICMP/UDP calls."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"macos:unifiedlog","channel":"com.apple.network","platforms":["macOS"],"analytic_id":"AN1256","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1256","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)","platforms":["macOS"],"analytic_id":"AN1256","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1256","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1257","name":"Analytic 1257","guidance":"VMCI (Virtual Machine Communication Interface) traffic between guest and host, or between VMs, originating from non-management tools or unauthorized binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1257","platforms":["ESXi"],"tuning":[{"field":"VMCIBackdoorProcess","description":"Monitor for non-vSphere or VMware-native processes using VMCI."},{"field":"GuestToHostCommPattern","description":"Baseline pattern of guest-to-host traffic vs anomaly (unexpected port, volume)."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"esxi:vmkernel","channel":"VMCI syslog entries","platforms":["ESXi"],"analytic_id":"AN1257","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1257","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1258","name":"Analytic 1258","guidance":"Non-standard port/protocol pairings or low-entropy ICMP traffic resembling tunneling patterns (e.g., fixed-size pings with delays).","url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1258","platforms":["Network Devices"],"tuning":[{"field":"ProtocolEntropyThreshold","description":"ICMP/UDP packet content entropy filter to identify encoded payloads."},{"field":"SessionDurationThreshold","description":"Long ICMP/UDP sessions beyond expected limits (e.g., >5min)."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Firewall","channel":"ICMP/UDP protocol anomaly","platforms":["Network Devices"],"analytic_id":"AN1258","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1258","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"conn.log, icmp.log","platforms":["Network Devices"],"analytic_id":"AN1258","source_url":"https://attack.mitre.org/detectionstrategies/DET0457#AN1258","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) can use TCP for C2 communications.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--ff5b6f0f-df63-4561-8c62-4894b3e424b7","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) can be configured to use raw TCP or UDP for command and control.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Dell TG-3390)","relationship_id":"relationship--2eaea386-ee0f-42c4-bca1-ce2d22062f98","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Dell TG-3390","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"id":"S0019","name":"Regin","url":"https://attack.mitre.org/software/S0019","kind":"malware","description":"The [Regin](https://attack.mitre.org/software/S0019) malware platform can use ICMP to communicate between infected computers.(Citation: Kaspersky Regin)","relationship_id":"relationship--e7ac3ee3-a014-4b07-9bad-b93d3d1d0f4b","references":[{"source_name":"Kaspersky Regin","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, November 24). THE REGIN PLATFORM NATION-STATE OWNAGE OF GSM NETWORKS. Retrieved December 1, 2014.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"[Derusbi](https://attack.mitre.org/software/S0021) binds to a raw socket on a random source port between 31800 and 31900 for C2.(Citation: Fidelis Turbo)","relationship_id":"relationship--c52eb151-c8c5-45f1-984b-d99a12ca05cf","references":[{"source_name":"Fidelis Turbo","description":"Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can communicate through custom methodologies for UDP,  ICMP, and TCP that use distinct sessions to ride over the legitimate protocols.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--3717f0c2-0963-4b6c-9603-bb01c06b9fe6","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has used an encrypted protocol within TCP segments to communicate with the C2.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--8f8adede-8b7a-460d-b852-b52328df178a","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0034","name":"NETEAGLE","url":"https://attack.mitre.org/software/S0034","kind":"malware","description":"If [NETEAGLE](https://attack.mitre.org/software/S0034) does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, [NETEAGLE](https://attack.mitre.org/software/S0034) will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.(Citation: FireEye APT30)","relationship_id":"relationship--b41abaa3-a21f-4d2c-9c60-c90c4f360b00","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0043","name":"BUBBLEWRAP","url":"https://attack.mitre.org/software/S0043","kind":"malware","description":"[BUBBLEWRAP](https://attack.mitre.org/software/S0043) can communicate using SOCKS.(Citation: FireEye admin@338)","relationship_id":"relationship--b9b0e376-f249-432f-a0d3-dfa259b4757a","references":[{"source_name":"FireEye admin@338","description":"FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"id":"S0055","name":"RARSTONE","url":"https://attack.mitre.org/software/S0055","kind":"malware","description":"[RARSTONE](https://attack.mitre.org/software/S0055) uses SSL to encrypt its communication with its C2 server.(Citation: Aquino RARSTONE)","relationship_id":"relationship--345c6135-7557-4292-8214-66618ba17edd","references":[{"source_name":"Aquino RARSTONE","description":"Aquino, M. (2013, June 13). RARSTONE Found In Targeted Attacks. Retrieved December 17, 2015.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/rarstone-found-in-targeted-attacks/"}]},{"id":"S0076","name":"FakeM","url":"https://attack.mitre.org/software/S0076","kind":"malware","description":"Some variants of [FakeM](https://attack.mitre.org/software/S0076) use SSL to communicate with C2 servers.(Citation: Scarlet Mimic Jan 2016)","relationship_id":"relationship--090813dc-b370-42e1-a211-4d9e3247968a","references":[{"source_name":"Scarlet Mimic Jan 2016","description":"Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}]},{"id":"S0083","name":"Misdat","url":"https://attack.mitre.org/software/S0083","kind":"malware","description":"[Misdat](https://attack.mitre.org/software/S0083) network traffic communicates over a raw socket.(Citation: Cylance Dust Storm)","relationship_id":"relationship--5e53b45b-ca14-4e8b-8c76-0cf9cb572a92","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0084","name":"Mis-Type","url":"https://attack.mitre.org/software/S0084","kind":"malware","description":"[Mis-Type](https://attack.mitre.org/software/S0084) network traffic can communicate over a raw socket.(Citation: Cylance Dust Storm)","relationship_id":"relationship--cef7d272-ee0c-4379-9d7b-63adf1f40252","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) uses a custom TCP protocol for C2.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)\t ","relationship_id":"relationship--d6c628b9-789a-416b-8abe-cd457e566346","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) is capable of using ICMP, TCP, and UDP for C2.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)","relationship_id":"relationship--4ee54acd-fc04-43c2-8cf6-2200a802d0b9","references":[{"source_name":"Symantec Remsec IOCs","description":"Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.","url":"http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"},{"source_name":"Kaspersky ProjectSauron Full Report","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"}]},{"id":"S0141","name":"Winnti for Windows","url":"https://attack.mitre.org/software/S0141","kind":"malware","description":"[Winnti for Windows](https://attack.mitre.org/software/S0141) can communicate using custom TCP.(Citation: Novetta Winnti April 2015)","relationship_id":"relationship--4fb5c14c-5a08-4116-bbb7-d6822649dfa0","references":[{"source_name":"Novetta Winnti April 2015","description":"Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}]},{"id":"S0149","name":"MoonWind","url":"https://attack.mitre.org/software/S0149","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) completes network communication via raw sockets.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--51c5e624-d08e-4750-91f9-fdc98ec56552","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can be configured to use TCP, ICMP, and UDP for C2 communications.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--c904b6b7-52f4-42fe-b921-bb5a490c0c3f","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0155","name":"WINDSHIELD","url":"https://attack.mitre.org/software/S0155","kind":"malware","description":"[WINDSHIELD](https://attack.mitre.org/software/S0155) C2 traffic can communicate via TCP raw sockets.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--1984ba26-2309-49db-8c42-75951d0ef678","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0158","name":"PHOREAL","url":"https://attack.mitre.org/software/S0158","kind":"malware","description":"[PHOREAL](https://attack.mitre.org/software/S0158) communicates via ICMP for C2.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--fce7fac2-91da-4903-95dc-fb54650c0859","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0172","name":"Reaver","url":"https://attack.mitre.org/software/S0172","kind":"malware","description":"Some [Reaver](https://attack.mitre.org/software/S0172) variants use raw TCP for C2.(Citation: Palo Alto Reaver Nov 2017)","relationship_id":"relationship--67f82f6c-18f1-4f1e-8352-b7ecf8839ea2","references":[{"source_name":"Palo Alto Reaver Nov 2017","description":"Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can use TCP in C2 communications.(Citation: Red Canary NETWIRE January 2020)(Citation: Unit 42 NETWIRE April 2020)","relationship_id":"relationship--eaf4c445-8af9-48b7-9971-01a371145fde","references":[{"source_name":"Red Canary NETWIRE January 2020","description":"Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"},{"source_name":"Unit 42 NETWIRE April 2020","description":"Duncan, B. (2020, April 3). GuLoader: Malspam Campaign Installing NetWire RAT. Retrieved January 7, 2021.","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"}]},{"id":"S0221","name":"Umbreon","url":"https://attack.mitre.org/software/S0221","kind":"malware","description":"[Umbreon](https://attack.mitre.org/software/S0221) provides access to the system via SSH or any other protocol that uses PAM to authenticate.(Citation: Umbreon Trend Micro)","relationship_id":"relationship--c4aec6a5-2c11-45a2-8c79-8cccf85179cb","references":[{"source_name":"Umbreon Trend Micro","description":"Fernando Mercês. (2016, September 5). Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems. Retrieved March 5, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/?_ga=2.180041126.367598458.1505420282-1759340220.1502477046"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) has a command built in to use a raw TCP socket.(Citation: CheckPoint Bandook Nov 2020) ","relationship_id":"relationship--7bf27f61-0191-4c20-ae96-96c38322470d","references":[{"source_name":"CheckPoint Bandook Nov 2020","description":"Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) has used TCP to download additional modules.(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--3957be97-305f-4d42-9978-868cb83918a2","references":[{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0262","name":"QuasarRAT","url":"https://attack.mitre.org/software/S0262","kind":"tool","description":"[QuasarRAT](https://attack.mitre.org/software/S0262) can use TCP for C2 communication.(Citation: CISA AR18-352A Quasar RAT December 2018)","relationship_id":"relationship--7e9168ae-f0dd-4223-bc4b-9f94b08f99ac","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","description":"CISA. (2018, December 18). Analysis Report (AR18-352A) Quasar Open-Source Remote Administration Tool. Retrieved August 1, 2022.","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has used raw sockets for network communication.(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--b499e6f7-77bc-422b-b7ef-058d223a69e6","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0335","name":"Carbon","url":"https://attack.mitre.org/software/S0335","kind":"malware","description":"[Carbon](https://attack.mitre.org/software/S0335) uses TCP and UDP for C2.(Citation: ESET Carbon Mar 2017)","relationship_id":"relationship--ae3c0dc8-de95-40bc-bced-a3c61d7ad605","references":[{"source_name":"ESET Carbon Mar 2017","description":"ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}]},{"id":"S0352","name":"OSX_OCEANLOTUS.D","url":"https://attack.mitre.org/software/S0352","kind":"malware","description":"[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has used a custom binary protocol over port 443 for C2 traffic.(Citation: Unit42 OceanLotus 2017)","relationship_id":"relationship--04610729-6f83-48d4-9f5b-1c1c4a39df3a","references":[{"source_name":"Unit42 OceanLotus 2017","description":"Erye Hernandez and Danny Tsechansky. (2017, June 22). The New and Improved macOS Backdoor from OceanLotus. Retrieved September 8, 2023.","url":"https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"}]},{"id":"S0394","name":"HiddenWasp","url":"https://attack.mitre.org/software/S0394","kind":"malware","description":"[HiddenWasp](https://attack.mitre.org/software/S0394) communicates with a simple network protocol over TCP.(Citation: Intezer HiddenWasp Map 2019)","relationship_id":"relationship--55b8f35b-7ccc-4da7-9ab1-40fe148cd182","references":[{"source_name":"Intezer HiddenWasp Map 2019","description":"Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.","url":"https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"}]},{"id":"S0430","name":"Winnti for Linux","url":"https://attack.mitre.org/software/S0430","kind":"malware","description":"[Winnti for Linux](https://attack.mitre.org/software/S0430) has used ICMP, custom TCP, and UDP in outbound communications.(Citation: Chronicle Winnti for Linux May 2019)","relationship_id":"relationship--40622bce-ea51-4744-9240-4a4c4bf83753","references":[{"source_name":"Chronicle Winnti for Linux May 2019","description":"Chronicle Blog. (2019, May 15). Winnti: More than just Windows and Gates. Retrieved April 29, 2020.","url":"https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"}]},{"id":"S0436","name":"TSCookie","url":"https://attack.mitre.org/software/S0436","kind":"malware","description":"[TSCookie](https://attack.mitre.org/software/S0436) can use ICMP to receive information on the destination server.(Citation: JPCert BlackTech Malware September 2019)","relationship_id":"relationship--20c30f4a-ff6f-4861-a88a-77d437374994","references":[{"source_name":"JPCert BlackTech Malware September 2019","description":"Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has used raw TCP for C2.(Citation: FireEye Metamorfo Apr 2018) ","relationship_id":"relationship--4bd30351-b64b-47cb-897b-951b76ca668b","references":[{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has used TCP in C2 communications.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--0997f41a-0232-4331-8a11-11a6433d8343","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to communicate with C2 with TCP over port 443.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--a7cdf456-9ad0-402b-a914-5f1ebcd873a3","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0498","name":"Cryptoistic","url":"https://attack.mitre.org/software/S0498","kind":"malware","description":"[Cryptoistic](https://attack.mitre.org/software/S0498) can use TCP in communications with C2.(Citation: SentinelOne Lazarus macOS July 2020)","relationship_id":"relationship--dd2c9cb1-9c5a-4c97-83e4-4beee309a7cb","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","description":"Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"The [PipeMon](https://attack.mitre.org/software/S0501) communication module can use a custom protocol based on TLS over TCP.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--7b510a6f-3e11-49b3-bf97-a1ca24bca663","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0502","name":"Drovorub","url":"https://attack.mitre.org/software/S0502","kind":"malware","description":"[Drovorub](https://attack.mitre.org/software/S0502) can use TCP to communicate between its agent and client modules.(Citation: NSA/FBI Drovorub August 2020)","relationship_id":"relationship--37b9ae2f-a386-41aa-90be-497de2d580f5","references":[{"source_name":"NSA/FBI Drovorub August 2020","description":"NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.","url":"https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"}]},{"id":"S0504","name":"Anchor","url":"https://attack.mitre.org/software/S0504","kind":"malware","description":"[Anchor](https://attack.mitre.org/software/S0504) has used ICMP in C2 communications.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--077ab82e-3847-4dab-80e2-5dc0ea7d8e9e","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0515","name":"WellMail","url":"https://attack.mitre.org/software/S0515","kind":"malware","description":"[WellMail](https://attack.mitre.org/software/S0515) can use TCP for C2 communications.(Citation: CISA WellMail July 2020)","relationship_id":"relationship--5be3684a-cb63-4328-bba0-22f14298b920","references":[{"source_name":"CISA WellMail July 2020","description":"CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"}]},{"id":"S0556","name":"Pay2Key","url":"https://attack.mitre.org/software/S0556","kind":"malware","description":"[Pay2Key](https://attack.mitre.org/software/S0556) has sent its public key to the C2 server over TCP.(Citation: Check Point Pay2Key November 2020)","relationship_id":"relationship--66200ea6-03b8-4c4f-a1d4-9041ddc70d8a","references":[{"source_name":"Check Point Pay2Key November 2020","description":"Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) uses a custom binary protocol over sockets for C2 communications.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--b46d0c20-61f1-4ab4-be3b-fa7dace805f0","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0587","name":"Penquin","url":"https://attack.mitre.org/software/S0587","kind":"malware","description":"The [Penquin](https://attack.mitre.org/software/S0587) C2 mechanism is based on TCP and UDP packets.(Citation: Kaspersky Turla Penquin December 2014)(Citation: Leonardo Turla Penquin May 2020)","relationship_id":"relationship--ce59452d-d258-435f-aa91-329de56eba8e","references":[{"source_name":"Kaspersky Turla Penquin December 2014","description":"Baumgartner, K. and Raiu, C. (2014, December 8). The ‘Penquin’ Turla. Retrieved March 11, 2021.","url":"https://securelist.com/the-penquin-turla-2/67962/"},{"source_name":"Leonardo Turla Penquin May 2020","description":"Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has used UDP for C2 communications.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--a726ffe8-d192-4f40-be21-ba2ffe32c670","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) has the ability to use TCP sockets to send data and ICMP to ping the C2 server.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--6b9778e3-14f7-4609-8621-d24e2a40c032","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) can use TCP in C2 communications.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--b23da7b5-0d2d-4cfa-a2ad-ea89d86fecc6","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0630","name":"Nebulae","url":"https://attack.mitre.org/software/S0630","kind":"malware","description":"[Nebulae](https://attack.mitre.org/software/S0630) can use TCP in C2 communications.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--4b387706-db60-46d2-bba4-148571381e60","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) has the ability use TCP to send or receive C2 packets.(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--b4cec817-37bb-4b1f-b165-26241efdcea0","references":[{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) has the ability to use TCP and UDP for communication.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--0b932e1a-e0a1-4123-bcfe-6957b9ef2409","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) has the ability to use TCP and UDP in C2 communications.(Citation: Trend Micro DRBControl February 2020)(Citation: Profero APT27 December 2020)","relationship_id":"relationship--cbe08a78-7997-4aef-9b29-b4b002accbc3","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) has the ability to use TCP and UDP in C2 communications.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--1aee2c50-660a-42ee-816d-5823ade525f3","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can communicate with its C2 server via TCP over port 5200.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--d580bb98-25fb-4cf4-9b3f-79b007939202","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) has used a raw TCP connection to communicate with the C2 server.(Citation: SekoiaBourhis_DiceLoader_Feb2024)   ","relationship_id":"relationship--432e82e0-54e5-487b-a538-6fc49d7cfc5c","references":[{"source_name":"SekoiaBourhis_DiceLoader_Feb2024","description":"Bourhis, P., Sekoia TDR. (2024, February 1). Unveiling the intricacies of DiceLoader. Retrieved May 14, 2025.","url":"https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"}]},{"id":"S0699","name":"Mythic","url":"https://attack.mitre.org/software/S0699","kind":"tool","description":"[Mythic](https://attack.mitre.org/software/S0699) supports WebSocket and TCP-based C2 profiles.(Citation: Mythc Documentation)\t","relationship_id":"relationship--5e168a94-8882-4e6d-bc61-e86588b52242","references":[{"source_name":"Mythc Documentation","description":"Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022.","url":"https://docs.mythic-c2.net/"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) has used a custom JSON-based protocol for its C&C communications.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--151da49e-c3ee-4615-b62e-c8a3c93a32a6","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1029","name":"AuTo Stealer","url":"https://attack.mitre.org/software/S1029","kind":"malware","description":"[AuTo Stealer](https://attack.mitre.org/software/S1029) can use TCP to communicate with command and control servers.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--2fe54d3f-0ac2-4579-8e78-81dc11b6386e","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1031","name":"PingPull","url":"https://attack.mitre.org/software/S1031","kind":"malware","description":" [PingPull](https://attack.mitre.org/software/S1031) variants have the ability to communicate with C2 servers using ICMP or TCP.(Citation: Unit 42 PingPull Jun 2022)","relationship_id":"relationship--a877e5c0-3fe6-40bb-bd02-ef4a9465aba3","references":[{"source_name":"Unit 42 PingPull Jun 2022","description":"Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can communicate with C2 over TCP and UDP.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--fc99ba1c-8782-4864-9009-77f8338cb3ed","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1049","name":"SUGARUSH","url":"https://attack.mitre.org/software/S1049","kind":"malware","description":"[SUGARUSH](https://attack.mitre.org/software/S1049) has used TCP for C2.(Citation: Mandiant UNC3890 Aug 2022)","relationship_id":"relationship--fee0eb4c-b629-45ea-ae20-d8f037fd658e","references":[{"source_name":"Mandiant UNC3890 Aug 2022","description":"Mandiant Israel Research Team. (2022, August 17). Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors. Retrieved September 21, 2022.","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}]},{"id":"S1051","name":"KEYPLUG","url":"https://attack.mitre.org/software/S1051","kind":"malware","description":"\n[KEYPLUG](https://attack.mitre.org/software/S1051) can use TCP and KCP (KERN Communications Protocol) over UDP for C2 communication.(Citation: Mandiant APT41)","relationship_id":"relationship--e9500f3a-11d5-46f5-96d8-14313b95142e","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can establish an indirect and raw TCP socket-based connection to the C2 server.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--45ef2a23-61b6-4f78-9d86-58a2d50a4ee0","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can use raw TCP for C2.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--3f424011-cde1-4ed5-b067-3cb4d6193d72","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) has the ability to use TCP for external C2.(Citation: Palo Alto Brute Ratel July 2022)","relationship_id":"relationship--d661c7eb-11bb-4ef4-804e-665cc361789c","references":[{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) establishes a TCP socket for C2 communication using the API `WSASocketW`.(Citation: Cybereason Royal December 2022)","relationship_id":"relationship--d942783e-906f-4d2c-963b-1cc2f8429ff1","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}]},{"id":"S1078","name":"RotaJakiro","url":"https://attack.mitre.org/software/S1078","kind":"malware","description":"[RotaJakiro](https://attack.mitre.org/software/S1078) uses a custom binary protocol using a type, length, value format over TCP.(Citation: netlab360 rotajakiro vs oceanlotus)","relationship_id":"relationship--b7f887ee-e0e5-4cab-9898-6dfed9b86f31","references":[{"source_name":"netlab360 rotajakiro vs oceanlotus","description":"Alex Turing. (2021, May 6). RotaJakiro, the Linux version of the OceanLotus. Retrieved June 14, 2023.","url":"https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"}]},{"id":"S1084","name":"QUIETEXIT","url":"https://attack.mitre.org/software/S1084","kind":"malware","description":"[QUIETEXIT](https://attack.mitre.org/software/S1084) can establish a TCP connection as part of its initial connection to the C2.(Citation: Mandiant APT29 Eye Spy Email Nov 22)","relationship_id":"relationship--647cf3e6-dcb2-4da2-a60d-b3118cb966bc","references":[{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","description":"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.(Citation: Bitdefender Sardonic Aug 2021)","relationship_id":"relationship--ffcb5325-43d1-4b54-a9a5-f785c628136e","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1099","name":"Samurai","url":"https://attack.mitre.org/software/S1099","kind":"malware","description":"[Samurai](https://attack.mitre.org/software/S1099) can use a proxy module to forward TCP packets to external hosts.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--6c0f270a-cf44-4d71-a398-1d822f1d48ac","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) can forward TCP packets between the C2 and a remote host.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--2302de7d-8c9a-4a92-93d3-e4b00c40b22d","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) uses ICMP for transmitting configuration information to and from its command and control server.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--300b191d-6832-48ae-ad82-040f066cac08","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1114","name":"ZIPLINE","url":"https://attack.mitre.org/software/S1114","kind":"malware","description":"[ZIPLINE](https://attack.mitre.org/software/S1114) can communicate with C2 using a custom binary protocol.(Citation: Mandiant Cutting Edge Part 2 January 2024)","relationship_id":"relationship--44494749-870a-4ca5-beee-85d88f78a693","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","description":"Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}]},{"id":"S1121","name":"LITTLELAMB.WOOLTEA","url":"https://attack.mitre.org/software/S1121","kind":"malware","description":"[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) can function as a stand-alone backdoor communicating over the `/tmp/clientsDownload.sock` socket.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--32ca8347-dcb9-47c6-a3c3-23e15d03fe68","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1140","name":"Spica","url":"https://attack.mitre.org/software/S1140","kind":"malware","description":"[Spica](https://attack.mitre.org/software/S1140) can use JSON over WebSockets for C2 communications.(Citation: Google TAG COLDRIVER January 2024)","relationship_id":"relationship--da6e7647-cfe3-4ba9-af97-d442ffed09cd","references":[{"source_name":"Google TAG COLDRIVER January 2024","description":"Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"id":"S1142","name":"LunarMail","url":"https://attack.mitre.org/software/S1142","kind":"malware","description":"[LunarMail](https://attack.mitre.org/software/S1142) can ping a specific C2 URL with the ID of a victim machine in the subdomain.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--b832110a-0610-4489-9729-a89064b8d61b","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1144","name":"FRP","url":"https://attack.mitre.org/software/S1144","kind":"tool","description":"[FRP](https://attack.mitre.org/software/S1144) can communicate over TCP, TCP stream multiplexing, KERN Communications Protocol (KCP), QUIC, and UDP.(Citation: FRP GitHub)","relationship_id":"relationship--0267872d-3408-409e-8ad8-d39b85ce6a99","references":[{"source_name":"FRP GitHub","description":"fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.","url":"https://github.com/fatedier/frp"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can use sockets for communications to its C2 server.(Citation: Kandji Cuckoo April 2024)","relationship_id":"relationship--b720dc1e-50b1-44f6-8c3e-2c6f78ef3497","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}]},{"id":"S1163","name":"SnappyTCP","url":"https://attack.mitre.org/software/S1163","kind":"malware","description":"[SnappyTCP](https://attack.mitre.org/software/S1163) spawns a reverse TCP shell following an HTTP-based negotiation.(Citation: PWC Sea Turtle 2023)","relationship_id":"relationship--baec7508-d69a-4e06-8bf7-6d85d95830c7","references":[{"source_name":"PWC Sea Turtle 2023","description":"PwC Threat Intelligence. (2023, December 5). The Tortoise and The Malware. Retrieved November 20, 2024.","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}]},{"id":"S1187","name":"reGeorg","url":"https://attack.mitre.org/software/S1187","kind":"malware","description":"[reGeorg](https://attack.mitre.org/software/S1187) can tunnel TCP sessions into targeted networks.(Citation: Fortinet reGeorg MAR 2019)","relationship_id":"relationship--e88cccd3-9559-4b33-adff-268e74bc932f","references":[{"source_name":"Fortinet reGeorg MAR 2019","description":"FortiGard Labs. (2019, March 12). ReGeorg.HTTP.Tunnel. Retrieved December 3, 2024.","url":"https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel"}]},{"id":"S1189","name":"Neo-reGeorg","url":"https://attack.mitre.org/software/S1189","kind":"malware","description":"[Neo-reGeorg](https://attack.mitre.org/software/S1189) can create multiple TCP connections for a single session.(Citation: GitHub Neo-reGeorg 2019)","relationship_id":"relationship--337835d7-bd03-48ae-bb34-9cf85ffbd4e4","references":[{"source_name":"GitHub Neo-reGeorg 2019","description":"L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024.","url":"https://github.com/L-codes/Neo-reGeorg/blob/master/README-en.md"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can use the Windows Socket networking library to communicate with attacker-controlled endpoints.(Citation: Cybereason StealBit Exfiltration Tool)\n","relationship_id":"relationship--caa3a157-248d-4866-8299-e3f9f5becd83","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]},{"id":"S1203","name":"J-magic","url":"https://attack.mitre.org/software/S1203","kind":"malware","description":"[J-magic](https://attack.mitre.org/software/S1203) can monitor incoming C2 communications sent over TCP to the compromised host.(Citation: Lumen J-Magic JAN 2025)","relationship_id":"relationship--24a917f3-08c0-4ba1-955d-7e9c65dc26f7","references":[{"source_name":"Lumen J-Magic JAN 2025","description":"Black Lotus Labs. (2025, January 23). The J-Magic Show: Magic Packets and Where to find them. Retrieved February 17, 2025.","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"}]},{"id":"S1204","name":"cd00r","url":"https://attack.mitre.org/software/S1204","kind":"malware","description":"[cd00r](https://attack.mitre.org/software/S1204) can monitor incoming C2 communications sent over TCP to the compromised host.(Citation: Hartrell cd00r 2002)(Citation: Lumen J-Magic JAN 2025)","relationship_id":"relationship--1b814125-87a8-4860-bf42-b43787216312","references":[{"source_name":"Lumen J-Magic JAN 2025","description":"Black Lotus Labs. (2025, January 23). The J-Magic Show: Magic Packets and Where to find them. Retrieved February 17, 2025.","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"},{"source_name":"Hartrell cd00r 2002","description":"Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible backdoor. Retrieved October 13, 2018.","url":"https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631"}]},{"id":"S1219","name":"REPTILE","url":"https://attack.mitre.org/software/S1219","kind":"malware","description":"[REPTILE](https://attack.mitre.org/software/S1219) can communicate using TLS over raw TCP.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Mandiant Fortinet Zero Day)\n","relationship_id":"relationship--b80f4569-d64a-48d4-9ff1-a4e4768e000c","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"S1221","name":"MOPSLED","url":"https://attack.mitre.org/software/S1221","kind":"malware","description":"[MOPSLED](https://attack.mitre.org/software/S1221) can use a custom binary protocol over TCP for C2 communication.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--c4adb795-a847-47e0-a629-2c430d43974d","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"id":"S1227","name":"StarProxy","url":"https://attack.mitre.org/software/S1227","kind":"malware","description":"[StarProxy](https://attack.mitre.org/software/S1227) has used TCP for C2 communications to target IPs or domains.  [StarProxy](https://attack.mitre.org/software/S1227) contained code to support both UDP and TCP connections.(Citation: Zscaler)","relationship_id":"relationship--e98a8ed8-24eb-4390-b528-5e023eafe69e","references":[{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has utilized TCP-based reverse shells.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)","relationship_id":"relationship--aaea7acb-2ae2-4527-ac83-6a56eb7cc6b3","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has established a connection with the C2 server over TCP traffic.(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) has also created a TCP reverse shell communicating via a socket connection over ports 1245, 80, 2245, 3001, and 5000.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--eeb6919d-5296-4438-a87a-651fd23ab580","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has used raw TCP on non-standard ports, such as 4044, for C2 communications and for HTTP communications, which include downloading binaries.(Citation: SophosGnGal_SystemBC_Dec2020)(Citation: AhnLab_SystemBC_Apr2022)","relationship_id":"relationship--c8c8c0bc-0240-4cd1-aff3-edbe19a91e57","references":[{"source_name":"AhnLab_SystemBC_Apr2022","description":"AhnLab. (2022, April 4). SystemBC Being Used by Various Attackers . Retrieved June 18, 2025.","url":"https://asec.ahnlab.com/en/33600/"},{"source_name":"SophosGnGal_SystemBC_Dec2020","description":"Gallagher, S., Gn, S. (2020, December 16). Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor. Retrieved May 16, 2025.","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can use a custom TCP protocol over Port 443 for C2.(Citation: ESET HiddenFace 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--45754d15-9deb-467f-801d-84c0a8a00238","references":[{"source_name":"ESET HiddenFace 2024","description":"Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"},{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]}],"actors":[{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"An [APT3](https://attack.mitre.org/groups/G0022) downloader establishes SOCKS5 connections for its initial C2.(Citation: FireEye Operation Double Tap)","relationship_id":"relationship--df4b49f1-71ca-4744-8554-47bf36174d89","references":[{"source_name":"FireEye Operation Double Tap","description":"Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"id":"G0037","name":"FIN6","url":"https://attack.mitre.org/groups/G0037","kind":"intrusion-set","description":"[FIN6](https://attack.mitre.org/groups/G0037) has used Metasploit Bind and Reverse TCP stagers.(Citation: Trend Micro FIN6 October 2019)","relationship_id":"relationship--d6cb7440-c39c-4bc2-b30e-5264a7f8753c","references":[{"source_name":"Trend Micro FIN6 October 2019","description":"Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020.","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used SOCKS5 over port 9050 for C2 communication.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025) ","relationship_id":"relationship--15025556-2b38-40de-98a0-e231a16a7949","references":[{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"id":"G0068","name":"PLATINUM","url":"https://attack.mitre.org/groups/G0068","kind":"intrusion-set","description":"[PLATINUM](https://attack.mitre.org/groups/G0068) has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.(Citation: Microsoft PLATINUM June 2017)","relationship_id":"relationship--c83da269-9c77-4941-bf69-8e79bdfa5edf","references":[{"source_name":"Microsoft PLATINUM June 2017","description":"Kaplan, D, et al. (2017, June 7). PLATINUM continues to evolve, find ways to maintain invisibility. Retrieved February 19, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/?source=mmpc"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has used TCP for C2.(Citation: Microsoft HAFNIUM March 2020)","relationship_id":"relationship--f503c254-b86c-433e-8107-585c53f23b6e","references":[{"source_name":"Microsoft HAFNIUM March 2020","description":"MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has utilized TCP-based reverse shells using cmd.exe.(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)","relationship_id":"relationship--88640feb-d423-4861-ac34-cb7a8fe4bfac","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}]},{"id":"G0135","name":"BackdoorDiplomacy","url":"https://attack.mitre.org/groups/G0135","kind":"intrusion-set","description":"[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--d92f4be1-6745-45a2-bfbb-c4cb227682d2","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"G1002","name":"BITTER","url":"https://attack.mitre.org/groups/G1002","kind":"intrusion-set","description":"[BITTER](https://attack.mitre.org/groups/G1002) has used TCP for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)","relationship_id":"relationship--e7f27ed5-a90a-49c0-bd81-a10a98f77574","references":[{"source_name":"Forcepoint BITTER Pakistan Oct 2016","description":"Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets.(Citation: Cadet Blizzard emerges as novel threat actor) [Ember Bear](https://attack.mitre.org/groups/G1003) has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--43edcf0f-1f37-48b6-aa89-aa845611e0f3","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1013","name":"Metador","url":"https://attack.mitre.org/groups/G1013","kind":"intrusion-set","description":"[Metador](https://attack.mitre.org/groups/G1013) has used TCP for C2.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--c65d4006-003c-4aff-a8c7-bd5834678b58","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"[ToddyCat](https://attack.mitre.org/groups/G1022) has used a passive backdoor that receives commands with UDP packets.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--6fabc88f-9582-4658-807c-7ec583edbd5e","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has used Generic Routing Encapsulation (GRE) and IPsec tunnels to connect to C2 over non-application layer protocols.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)    ","relationship_id":"relationship--2b218139-1e96-4e15-9ac3-8d83b4aff072","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Mandiant Fortinet Zero Day)\n","relationship_id":"relationship--cd9ce33c-994d-4378-96b3-10cce4bdf8fa","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","description":"Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]}],"mitigations":[{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.","relationship_id":"relationship--b2a42d95-fc64-4e6f-95d9-7b24334bccd4","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.","relationship_id":"relationship--418bde38-35eb-44bc-a454-ad7d2918bda5","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Filter network traffic to prevent use of protocols across the network boundary that are unnecessary.  If VMCI is not required in ESXi environments, consider restricting guest virtual machines from accessing VMCI services.(Citation: Broadcom VMCI Firewall)","relationship_id":"relationship--9acd9add-9b08-45dd-8135-98e62eb708e2","references":[{"source_name":"Broadcom VMCI Firewall","description":"Broadcom. (2025, March 24). Configure Virtual Machine Communication Interface Firewall. Retrieved March 31, 2025.","url":"https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-virtual-machine-administration-guide-7-0/configuring-virtual-machine-hardwarevm-admin/virtual-machine-network-configurationvm-admin/serial-port-configurationvm-admin/configure-the-virtual-machine-communication-interface-firewallvm-admin.html"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Periodically investigate ESXi hosts for open VMCI ports. Running the `lsof -A` command and inspecting results with a type of `SOCKET_VMCI` will reveal processes that have open VMCI ports.(Citation: Google Cloud Threat Intelligence ESXi Hardening 2023)","relationship_id":"relationship--8ad2d1c5-aa94-4c32-94c8-8ffb9d11f54a","references":[{"source_name":"Google Cloud Threat Intelligence ESXi Hardening 2023","description":"Alex Marvi, Greg Blaum, and Ron Craft. (2023, June 28). Detection, Containment, and Hardening Opportunities for Privileged Guest Operations, Anomalous Behavior, and VMCI Backdoors on Compromised VMware Hosts. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-detection-containment-hardening"}]}],"candidates":[{"id":"0268e63c-e244-42db-bef7-72a9e59fc1fc","name":"ICMP C2","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1095/T1095.yaml","description":"This will attempt to  start C2 Session Using ICMP. For information on how to set up the listener\nrefer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/\n","inputs":{"server_ip":{"description":"The IP address of the listening server","type":"string","default":"127.0.0.1"}},"dependencies":[],"source_definition_sha256":"602b0150606b53b6d5f18362de4b76e4c9d09f39f69ab11711c61c88bb7717ad"},{"id":"3e0e0e7f-6aa2-4a61-b61d-526c2cc9330e","name":"Powercat C2","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1095/T1095.yaml","description":"Start C2 Session Using Powercat\nTo start the listener on a Linux device, type the following: \nnc -l -p <port>\n","inputs":{"server_ip":{"description":"The IP address or domain name of the listening server","type":"string","default":"127.0.0.1"},"server_port":{"description":"The port for the C2 connection","type":"integer","default":80}},"dependencies":[],"source_definition_sha256":"3d8d6a6ca5c3cda2a24176dee1f61b2378bb9d5a6aa00853bbe659309784a0f3"},{"id":"8e139e1f-1f3a-4be7-901d-afae9738c064","name":"Linux ICMP Reverse Shell using icmp-cnc","platforms":["linux"],"method":"manual","executor":"manual","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1095/T1095.yaml","description":"ICMP C2 (Command and Control) utilizes the Internet Control Message Protocol (ICMP), traditionally used for network diagnostics, as a covert communication channel for attackers. By using ICMP, adversaries can send commands, exfiltrate data, or maintain access to compromised systems without triggering network detection systems.\nThis method allows attackers to communicate and control compromised devices while remaining undetected.\n\nFor more details, check this blog: [ICMP Reverse Shell Blog](https://cryptsus.com/blog/icmp-reverse-shell.html)\n\n**Important Notes:**\n- Use `[icmp-cnc]` for the C2 server (Attacker) and `[icmpdoor]` for the C2 client (Victim).\n- Binaries work on Ubuntu 22.04.5 LTS; for CentOS Stream or other, use the Python file from the GitHub link [https://github.com/krabelize/icmpdoor].\n- Root access is required.\n","inputs":{},"dependencies":[],"source_definition_sha256":"8a8a1562397deef5c4cc490a2094a21e0a063ff10a342827d5c98253891260fa"},{"id":"b2858526-001a-4b94-8036-d18dab2898a6","name":"Turla Topinambour TCP Callback via Inline .NET","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1095/T1095.yaml","description":"Attempts a TCP socket connection to a specified IP on port 13277 with a .NET payload, mirroring how Topinambour connects to hardcoded C2 addresses to establish a remote shell.\nDefaults to 127.0.0.1 so the attempt fails safely without a listener. The socket has a 5 second connection\ntimeout via Poll, and a 20 second receive timeout.\n\nReference: https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/\n","inputs":{"callback_ip":{"description":"IP address to connect back to (simulates C2 server)","type":"string","default":"127.0.0.1"}},"dependencies":[],"source_definition_sha256":"14b9296d930577ca0a0a17a2ed27a04dbb62aa2ea5d06a7ca399ad3317d04a1b"},{"id":"bcf0d1c1-3f6a-4847-b1c9-7ed4ea321f37","name":"Netcat C2","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1095/T1095.yaml","description":"Start C2 Session Using Ncat\nTo start the listener on a Linux device, type the following: \nnc -l -p <port>\n","inputs":{"server_port":{"description":"The port for the C2 connection","type":"integer","default":80},"ncat_exe":{"description":"The location of ncat.exe","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1095\\nmap-7.80\\ncat.exe"},"ncat_path":{"description":"The folder path of ncat.exe","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1095"},"server_ip":{"description":"The IP address or domain name of the listening server","type":"string","default":"127.0.0.1"}},"dependencies":[{"description":"ncat.exe must be available at specified location (#{ncat_exe})\n"}],"source_definition_sha256":"66619f8de0ed71d814f02a0d1a1610d87c763903bf6798c3f9347b4087a25cb4"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1095":"/ttp-simulation/techniques/enterprise/T1095/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1095","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}