Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.