Threat intelligence / Technique

Web Service

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

55 recorded

Relationships

mitigates

from Network Intrusion Prevention

Mitigation

mitigates

from Restrict Web-Based Content

Mitigation

subtechnique-of

from Bidirectional Communication

Technique

subtechnique-of

from Dead Drop Resolver

Technique

subtechnique-of

from One-Way Communication

Technique

uses

from APT32

Group

uses

from APT41 DUST

Campaign

uses

from APT42

Group

uses

Malware

uses

Malware

uses

from Bazar

Malware

uses

Malware

uses

from BRICKSTORM

Malware

uses

from Brute Ratel C4

Tool

uses

Malware

uses

from C0017

Campaign

uses

from C0027

Campaign

uses

Malware

uses

from CharmPower

Malware

uses

from CHIMNEYSWEEP

Malware

uses

from DarkTortilla

Malware

uses

from Doki

Malware

uses

Malware

uses

from EXOTIC LILY

Group

uses

from FIN6

Group

uses

from FIN8

Group

uses

from Fox Kitten

Group

uses

from Gamaredon Group

Group

uses

Malware

uses

Malware

uses

Group

uses

Malware

uses

from Latrodectus

Malware

uses

from LazyScripter

Group

uses

Malware

uses

from Mustang Panda

Group

uses

Malware

uses

from ngrok

Tool

uses

Malware

uses

from Operation Spalax

Campaign

uses

from PureCrypter

Malware

uses

from Raspberry Robin

Malware

uses

Group

uses

from RedLine Stealer

Malware

uses

from Rocke

Group

uses

from SharpStage

Malware

uses

from ShrinkLocker

Malware

uses

from Sibot

Malware

uses

Malware

uses

from Snip3

Malware

uses

from SocGholish

Malware

uses

Group

uses

from Turla

Group

uses

from VOID MANTICORE

Group

uses

from WhisperGate

Malware

3 external

References

mitre-attack

T1102

Broadcom BirdyClient Microsoft Graph API 2024

https://www.broadcom.com/support/security-center/protection-bulletin/birdyclient-malware-leverages-microsoft-graph-api-for-c-c-communication

University of Birmingham C2

https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf