WellMess

TLS-сертификаты Digital Certificates T1596.003... Сертификаты - одна из самых сильных pivot-точек для картирования инфраструктуры хакеров.

За это время аналитик может обнаружить сервер через сканирование баз данных Scan Databases (T1596.005, Reconnaissance)

The group then deployed publicly known exploits against the vulnerable systems it found, including popular Citrix, Pulse Secure, and Fortinet devices, among others.

Specifically, APT29 uses a variety of tools and techniques, including spear phishing and custom malware known as “WellMess” and “WellMail”, according to the NCSC.

The program is capable of encrypting, decrypting, uploading and downloading files. The malware can also execute commands and send and receive encrypted communications.

The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Company Name Microsoft Corporation File Description Power Settings Command-Line Tool Internal Name powercfg.exe Original Filename powercfg.exe

Based on our observations, Russian state-attributed actors often use better operational security for C2 infrastructure... We also observe that when their C2 infrastructure is publicly reported upon, it is often quickly dispensed with.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

These artifacts create detection opportunities for defenders, and include software versions deployed on the server, the login panel, TLS certificate patterns...

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

Both collect the state of system privileges (disabled or enabled) from the infected system

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

The program is capable of encrypting, decrypting, uploading and downloading files... It performs functions based on the received commands: File upload File download

Displayed below is sample communication traffic between this WellMess implant and its C2 server. —Begin Sample Network Traffic— POST / HTTP/1.1 ... Cookie: ... | These implants allow a remote operator to establish encrypted command and control (C2) sessions... The function appears to be the main export of the DLL, which initiates a C2 session with the implants remote C2 server at the Internet Protocol (IP) address, 85.93.2.116.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

When the file is executed, it attempts to create a C2 connection to one of the following IP addresses: 141.98.212.55 over Transmission Control Protocol(TCP) Port 53 209.58.186.196 over TCP Port 443

Both versions also allow an operator to pass AES encrypted executable scripts to infected systems... The malware can receive and parse messages from the remote operator.

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

"communicate with C2 over mutual TLS"; "client and server mutually check certificates"; "can use mutual TLS and RSA cryptography to exchange a session key". | Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.