| ID | Name |
|---|---|
| T1102.001 | Dead Drop Resolver |
| T1102.002 | Bidirectional Communication |
| T1102.003 | One-Way Communication |
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
| ID | Name | Description |
|---|---|---|
| C0057 | 3CX Supply Chain Attack |
During the 3CX Supply Chain Attack, AppleJeus leveraged a GitHub repository to host icon files containing the command and control URL.[1][2] |
| G0096 | APT41 |
APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.[3] |
| S0373 | Astaroth |
Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.[4] |
| S0128 | BADNEWS |
BADNEWS collects C2 information via a dead drop resolver.[5][6][7] |
| S0069 | BLACKCOFFEE |
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.[8][9] |
| G0060 | BRONZE BUTLER |
BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.[10] |
| C0017 | C0017 |
During C0017, APT41 used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably APT41 updated the community forum posts frequently with new dead drop resolvers during the campaign.[11] |
| S0674 | CharmPower |
CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.[12] |
| S0531 | Grandoreiro |
Grandoreiro can obtain C2 information from Google Docs.[4] |
| S0528 | Javali |
Javali can read C2 information from Google Documents and YouTube.[4] |
| S1051 | KEYPLUG |
The KEYPLUG Windows variant has retrieved C2 addresses from encoded data in posts on tech community forums.[11] |
| G0094 | Kimsuky |
Kimsuky has used TRANSLATEXT and a dead drop resolver to retrieve configurations and commands from a public blog site.[13] |
| S0455 | Metamorfo |
Metamorfo has used YouTube to store and hide C&C server domains.[14] |
| S0051 | MiniDuke |
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.[15][16][17] |
| S1221 | MOPSLED |
MOPSLED has the ability to retrieve a C2 address from a dead drop URL.[18] |
| G0040 | Patchwork |
Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.[19] |
| S0013 | PlugX | |
| S0518 | PolyglotDuke |
PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.[17] |
| G0106 | Rocke |
Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.[21] |
| S0148 | RTM |
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.[22][23][24] |
| G0048 | RTM |
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.[22] |
| S1201 | TRANSLATEXT |
TRANSLATEXT has used a dead drop resolver to retrieve configurations and commands from a public blog site.[13] |
| S0341 | Xbash |
Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.[25] |
| ID | Mitigation | Description |
|---|---|---|
| M1031 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. |
| M1021 | Restrict Web-Based Content |
Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0058 | Detection Strategy for Web Service: Dead Drop Resolver | AN0158 |
Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior). |
| AN0159 |
Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior). |
||
| AN0160 |
Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior). |
||
| AN0161 |
Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior). |