The attacker may use phishing emails with malicious attachments to deliver and execute a malicious tool, such as a reverse shell, on the victim’s machine. The tool will likely use web protocols to communicate with the attacker’s C2 server.
Tag: T1583.001
Sea Turtle
The attacker is actively scanning the internet for vulnerable hosts, and then compromising those hosts for future malicious activity.