Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.1 Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
- Broadcom BirdyClient Microsoft Graph API 2024
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0100 | Inception | — |
| grp_g1011 | EXOTIC LILY | — |
| grp_g0117 | Fox Kitten | — |
| grp_g0129 | Mustang Panda | China |
| grp_g0037 | FIN6 | — |
| grp_g1039 | RedCurl | Russia |
| grp_g1044 | APT42 | Iran |
| grp_g1055 | VOID MANTICORE | — |
| grp_g0061 | FIN8 | — |
| grp_g0010 | Turla | Russia |
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0139 | TeamTNT | — |
| grp_g0140 | LazyScripter | — |
| grp_g0106 | Rocke | — |
| grp_g0050 | APT32 | Vietnam |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.