Technique:  Web Service:Bidirectional Communication
It has used blogs and WordPress for C2 infrastructure.
It has used Google Drive for C2.
It leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.
It has communicated with C2 through files uploaded to and downloaded from DropBox.
BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.
BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.
BLUELIGHT can use different cloud providers for its C2.
BoxCaon has used DropBox for C2 communications.
The CALENDAR malware communicates through the use of events in Google Calendar.
It has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.
Clambling can use Dropbox to download malicious payloads, send commands, and receive information.
One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.
Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.
ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.
CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.
CreepyDrive can use OneDrive for C2.
Crutch can use Dropbox to receive commands and upload stolen data.
DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.
Empire can use Dropbox and GitHub for C2.
It used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.
GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.
Grandoreiro can utilize web services including Google sites to send and receive C2 data.
It has used cloud services, including OneDrive, for C2.
KARAE can use public cloud-based storage providers for command and control.
Kazuar has used compromised WordPress blogs as C2 servers.
It has used Blogspot pages for C2.
It has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.
LOWBALL uses the Dropbox cloud storage service for command and control.
It malware can use a SOAP Web service to communicate with its C2 server.
It has used web services including OneHub to distribute remote access tools.
For Operation Ghost, It used social media platforms to hide communications to C2 servers.
Orz has used Technet and Pastebin web pages for command and control.
It has used OneDrive and DropBox for C2.
POORAIM has used AOL Instant Messenger for C2.
PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use.
RegDuke can use Dropbox as its C2 server.
Revenge RAT used blogpost.com as its primary command and control server during a campaign.
RogueRobin has used Google Drive as a Command and Control channel.
ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.
It has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. It also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.
SLOWDRIFT uses cloud based services for C2.
Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.
A It JavaScript backdoor has used Google Apps Script as its C2 server.
UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.
yty communicates to the C2 server by retrieving a Google Doc.
ItM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.