WellMess

The group then deployed publicly known exploits against the vulnerable systems it found, including popular Citrix, Pulse Secure, and Fortinet devices, among others.

Specifically, APT29 uses a variety of tools and techniques, including spear phishing and custom malware known as “WellMess” and “WellMail”, according to the NCSC.

The program is capable of encrypting, decrypting, uploading and downloading files. The malware can also execute commands and send and receive encrypted communications.

The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Company Name Microsoft Corporation File Description Power Settings Command-Line Tool Internal Name powercfg.exe Original Filename powercfg.exe

Based on our observations, Russian state-attributed actors often use better operational security for C2 infrastructure... We also observe that when their C2 infrastructure is publicly reported upon, it is often quickly dispensed with.

The encrypted data is then encoded using the Base64 encoding function. It trims Base64 "=" | "/" | ":" and adds spaces... The malware contains functions for encrypting, decrypting...

These artifacts create detection opportunities for defenders, and include software versions deployed on the server, the login panel, TLS certificate patterns...

The content repeatedly describes actors and malware using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, netsh interface show, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking admin status, and enumerating user sessions.

Both collect the state of system privileges (disabled or enabled) from the infected system

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

The program is capable of encrypting, decrypting, uploading and downloading files... It performs functions based on the received commands: File upload File download

"...accept and execute shell scripts from a remote operator."; "...receive scripts compressed (tar files)... decompress them before executing the embedded script."

Displayed below is sample communication traffic between this WellMess implant and its C2 server. —Begin Sample Network Traffic— POST / HTTP/1.1 ... Cookie: ... | These implants allow a remote operator to establish encrypted command and control (C2) sessions... The function appears to be the main export of the DLL, which initiates a C2 session with the implants remote C2 server at the Internet Protocol (IP) address, 85.93.2.116.

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

When the file is executed, it attempts to create a C2 connection to one of the following IP addresses: 141.98.212.55 over Transmission Control Protocol(TCP) Port 53 209.58.186.196 over TCP Port 443

Both versions also allow an operator to pass AES encrypted executable scripts to infected systems... The malware can receive and parse messages from the remote operator.

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

"communicate with C2 over mutual TLS"; "client and server mutually check certificates"; "can use mutual TLS and RSA cryptography to exchange a session key". | Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.