C2_Communication_of_ThreatNeedle.pdf

This report analyzes a remote-access trojan ("Troy") campaign that exploits IIS/WebDAV and ATMFD vulnerabilities (CVE-2017-7269, CVE-2016-7256), deploys ASP webshells, and operates a multi-tier C2 architecture (Proxy, Mid, Manager) to issue commands, collect device information and exfiltrate files; it includes code samples, log excerpts, command tables and diagrams mapping the malware’s communication and operator workflows.