In my previous blog post, I explained and tested how C2 over trusted DNS protocol works. Advanced C2 can be implemented in many ways. One interesting technique is the use of trusted services as a covert C2 tunnel, classified by MITRE as T1102.
https://attack.mitre.org/techniques/T1102
LLMs such as ChatGPT, Gemini, and Claude are widely used and trusted in enterprise environments. This raises a question: can a public LLM be used as a covert command-and-control channel? Let’s examine which LLM capabilities could be leveraged for C2. There are two potential features that could be used.
The first approach is to use an LLM to visit websites and retrieve updates. In theory, this allows building a custom HTTPS-based C2:
- The attacker publishes commands on a dedicated C2 website.
- The compromised machine prompts the LLM to check for new content on that site.
- The LLM visits the website.
- The compromised machine receives the response from the LLM and extracts the command.
In theory, this is simple. In practice, LLMs have filters and may not behave as expected. This needs validation.
The second option is to use the LLM file service. Gemini, ChatGPT, and Claude provide APIs such as Files API. The LLM can read files from this service, and we can also read and write files via API. The concept is similar to a dedicated C2 website, but instead of hosting infrastructure, the Files API becomes the command exchange layer.
These are theoretical approaches. As mentioned, LLMs include safety filters, so passing C2 commands may not always be possible. I built a working prototype, which I will describe in the next posts.