termbin.com

C&C Exfiltration Download

None

termbin.com can be used for C&C purposes. The attacker will place commands on a pastie and have the malware fetch the commands.

Attackers will paste sensitive data onto termbin.com and share the link with themselves for later access.

Attackers upload the source code of tools onto termbin.com and download them when necessary.

https://blogs.vmware.com/emea-en/2022/05/serpent-the-backdoor-that-hides-in-plain-sight/