It has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. It has also used legitimate web services such as Dropbox and Constant Contact in their operations.