value:  The CALENDAR malware communicates through the use of events in Google Calendar. ;; Carbanak has used a VBScript named ggldr" that uses Google Apps Script Sheets and Forms services for C2. ;; One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators. ;; Comnie uses blogs and third-party sites (GitHub tumbler and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server. ;; ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information. ;; CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file. ;; Crutch can use Dropbox to receive commands and upload stolen data. ;; DOGCALL is capable of leveraging cloud storage APIs such as Cloud Box Dropbox and Yandex for C2. ;; Empire can use Dropbox and GitHub for C2. ;; FIN7 used legitimate services like Google Docs Google Scripts and Pastebin for C2. ;; GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol. ;; Grandoreiro can utilize web services including Google sites to send and receive C2 data. ;; KARAE can use public cloud-based storage providers for command and control. ;; Kazuar has used compromised WordPress blogs as C2 servers. ;; LOWBALL uses the Dropbox cloud storage service for command and control. ;; Magic Hound malware can use a SOAP Web service to communicate with its C2 server. ;; MuddyWater has used web services including OneHub to distribute remote access tools. ;; Orz has used Technet and Pastebin web pages for command and control. ;; POORAIM has used AOL Instant Messenger for C2. ;; PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use. ;; RegDuke can use Dropbox as its C2 server. ;; Revenge RAT used blogpost.com as its primary command and control server during a campaign. ;; RogueRobin has used Google Drive as a Command and Control channel. ;; ROKRAT leverages legitimate social networking sites and cloud platforms (Twitter Yandex and Mediafire) for C2 communications. ;; Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com. ;; SLOWDRIFT uses cloud based services for C2. ;; A Turla JavaScript backdoor has used Google Apps Script as its C2 server. ;; UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications. ;; yty communicates to the C2 server by retrieving a Google Doc. ;; ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands."
name: Web Service: Bidirectional Communication