WEBC2

Executive Summary

WEBC2 is a Windows backdoor used by APT1 since 2006 that retrieves and decodes commands hidden within HTML comments from a preconfigured C&C server via standard HTTP traffic. It persists through registry run keys, can download additional modules, and provides full remote control of compromised hosts. Due to its reliance on legitimate web protocols, detection requires focused network and host monitoring to identify anomalous request patterns.

WEBC2 is a legacy Windows backdoor that first appeared in Mandiant’s APT1 case study in July 2006. The malware’s core function is to retrieve webpages from a predetermined command-and-control (C&C) server, parsing commands that are cleverly hidden inside HTML comments or custom tags. By using ordinary HTTP(S) traffic and mimicking legitimate browser User‑Agent strings, the backdoor blends into normal web activity, making it difficult for both network perimeter defenses and simple host‑based scanners to spot. Once downloaded, WEBC2 persists by adding executable paths to a registry run key under either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER. The persistence mechanism allows it to automatically launch on system boot with the same user privileges that were first used to trigger its execution. Additionally, the backdoor can download supplementary modules or payloads from the C&C server; these modules are executed in memory, further increasing its evasiveness. Operationally, WEBC2 provides threat actors with a remote command interface: commands embedded in comments are extracted, decoded, and then carried out on the infected host. The attacker can exfiltrate data, harvest credentials, or implant additional malware components. Although the code base is simple compared to modern APT toolkits, its long‑term use demonstrates the effectiveness of stealthy HTTP‑based command channels for low‑profile persistence in enterprise environments.

Key Capabilities

• Retrieves command pages over HTTP/HTTPS from a predetermined C&C server
• Parses commands hidden in HTML comments or custom tags
• Persists by adding registry run keys to launch on startup
• Downloads and loads additional modules dynamically
• Uses legitimate User‑Agent strings and normal web traffic patterns for stealth
• Can potentially exfiltrate data, harvest credentials, and log keystrokes
• Employs basic obfuscation via HTML comment embedding

ATT&CK Techniques

Recommended Actions

• Block outbound DNS or HTTP(S) queries to known WEBC2 C&C domains and IP addresses using firewall and proxy rules
• Monitor HTTP/S traffic for requests containing unusual comment markers or custom tags, especially from privileged accounts
• Scan endpoints for registry run keys pointing to WEBC2 binaries and deploy EDR signatures matching the backdoor’s binary hash
• Update antivirus/EDR databases with WEBC2 detection patterns and known malicious file hashes
• Implement TLS inspection or web proxies to detect hidden command traffic in HTTPS streams
• Perform a detailed endpoint investigation on hosts with suspicious persistence entries to uncover additional compromise artifacts

Suggested Tags