Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1102.001: Dead Drop Resolver

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

EnterpriseT1102.001Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Dead Drop Resolver is a command-and-control behavior where malware uses a legitimate external web service, such as a popular website or social media platform, to find the real C2 address. This matters because the first network contact may look like normal business web traffic, especially over SSL/TLS, while the actual back-end infrastructure can change dynamically. For leaders, the key issue is whether the organization can distinguish expected use of common web services from infected hosts retrieving hidden C2 pointers.

Executive priority

Prioritize this as a resilience and visibility problem, not just a malware indicator problem. Blocking one domain or IP may not be enough because the resolver can point to changing infrastructure and legitimate services may be difficult to block outright. Executives should ask whether web access governance, proxy controls, network intrusion prevention, and SOC playbooks can handle suspicious use of otherwise trusted services without disrupting business operations. This technique is also useful for audit and compliance discussions around outbound traffic control, encrypted web visibility, and incident response evidence retention.

Technical view

This is an enterprise command-and-control sub-technique under Web Service and applies to ESXi, Linux, macOS, and Windows environments. SOC and detection teams should validate coverage for hosts contacting legitimate external web services and then following embedded, encoded, obfuscated, or unusual domains/IPs. ATT&CK provides no official detection text for this object, but the relationship to DET0058 indicates a dedicated detection strategy exists for Web Service: Dead Drop Resolver. Relationships to multiple campaigns, groups, and malware families show the behavior is not limited to one toolset; use that as context for detection engineering, not as proof of local attribution.

Likely telemetry

  • Web proxy and secure web gateway logs showing outbound requests to popular external web services
  • DNS query and response logs for follow-on domains discovered after web-service access
  • Network intrusion detection/prevention events at internet boundaries
  • TLS/SSL connection metadata, including destination, timing, certificate, and SNI where available
  • Endpoint process-to-network connection telemetry across Windows, Linux, macOS, and ESXi where collected

Detection direction

  • Baseline normal organizational use of common web services so suspicious resolver-like access patterns are not lost in expected noise.
  • Look for sequences where an endpoint accesses a legitimate web service and soon after connects to uncommon or newly observed external domains or IP addresses.
  • Tune detections for encoded, obfuscated, or unusual content retrieval from pages, feeds, posts, or similar web-hosted content, while accounting for legitimate automation and user activity.
  • Correlate web proxy, DNS, network, and endpoint process telemetry; any single source may be insufficient because SSL/TLS and common-service usage can obscure content.
  • Validate whether DET0058-aligned logic is implemented locally, but do not assume coverage because the ATT&CK object itself does not provide official detection details.

Mitigation priorities

  • Start with Restrict Web-Based Content: enforce policy-driven controls such as URL filtering, download restrictions, script blocking, and control of unauthorized browser behaviors where appropriate.
  • Use Network Intrusion Prevention at network boundaries to block known malicious or policy-violating traffic when signatures or reliable indicators are available.
  • Define acceptable-use and exception processes for popular web services so defenders can act on suspicious use without creating unmanaged business disruption.
  • Retain outbound web, DNS, and network evidence long enough to support incident response reconstruction when a resolver points to changing back-end C2 infrastructure.
  • Review controls across all supported enterprise platforms in scope: ESXi, Linux, macOS, and Windows.
Analyst notes and limits

The relationship set includes campaigns, groups, and software such as C0017, the 3CX Supply Chain Attack, Patchwork, RTM, APT41, Rocke, PlugX, MiniDuke, BLACKCOFFEE, BADNEWS, Xbash, Astaroth, Metamorfo, PolyglotDuke, Javali, Grandoreiro, and CharmPower. These relationships support the conclusion that the technique appears across varied intrusion contexts, but they should not be used alone for attribution. The most important local validation is whether common web-service traffic is observable, baselined, and correlated with follow-on outbound connections.

The supplied ATT&CK object does not include official detection text, specific analytics, data components, or vendor implementation guidance. The mitigation descriptions are high level, and local feasibility depends on business use of external web services, encrypted traffic visibility, privacy requirements, and available telemetry. No claim of active exploitation or customer exposure is made from this object alone.

Official MITRE ATT&CK definition

Dead Drop Resolver

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1102 Web Service This object subtechnique of Web Service.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0106: Rocke

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.[1]

Group Enterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

Group Enterprise

G0048: RTM

RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM). [1]

Group Enterprise

G0060: BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Group Enterprise

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

Malware Enterprise

S0373: Astaroth

Astaroth is a Trojan and information stealer known to affect companies in Europe, Brazil, and throughout Latin America. It has been known publicly since at least late 2017. [1][2][3]

Windows
Malware Enterprise

S0128: BADNEWS

BADNEWS is malware that has been used by the actors responsible for the Patchwork campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control. [1] [2]

Windows
Malware Enterprise

S1051: KEYPLUG

KEYPLUG is a modular backdoor written in C++, with Windows and Linux variants, that has been used by APT41 since at least June 2021.[1]

LinuxWindows
Malware Enterprise

S0531: Grandoreiro

Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.[1][2]

Windows
Malware Enterprise

S0455: Metamorfo

Metamorfo is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.[1][2]

Windows
Malware Enterprise

S9010: GlassWorm

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]

macOSWindows
Malware Enterprise

S1201: TRANSLATEXT

TRANSLATEXT is malware that is believed to be used by Kimsuky.[1] TRANSLATEXT masqueraded as a Google Translate extension for Google Chrome, but is actually a collection of four malicious Javascript files that perform defense evasion, information collection and exfiltration.[1]

Windows
Malware Enterprise

S9034: Tsundere Botnet

Tsundere Botnet is a botnet first reported in mid-2025 that is delivered via MSI installer or a PowerShell script. It leverages Node.js and JavaScript for payload delivery and execution, and uses smart contracts on the blockchain to host command and control (C2) addresses. Tsundere Botnet is attributed to a likely Russian-speaking threat actor.

A variant named DinDoor has been linked to MuddyWater operations and uses the Deno runtime for execution rather than Node.js.[1][2][3][4]

LinuxmacOSWindows
Campaign Enterprise

C0057: 3CX Supply Chain Attack

The 3CX Supply Chain Attack was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with AppleJeus, access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.[1] While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.[2] The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.[3][4]

Campaign Enterprise

C0017: C0017

C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).[1]

Relationship explorer

All related ATT&CK context

uses · Malware S0373: Astaroth Enterprise uses · Malware S0128: BADNEWS Enterprise uses · Malware S1051: KEYPLUG Enterprise uses · Malware S0051: MiniDuke Enterprise uses · Malware S0531: Grandoreiro Enterprise detects · Detection Strategy DET0058: Detection Strategy for Web Service: Dead Drop Resolver Enterprise uses · Malware S0455: Metamorfo Enterprise uses · Malware S0013: PlugX Enterprise uses · Malware S9010: GlassWorm Enterprise subtechnique of · Technique T1102: Web Service Enterprise uses · Malware S0674: CharmPower Enterprise mitigates · Mitigation M1021: Restrict Web-Based Content Enterprise uses · Malware S1201: TRANSLATEXT Enterprise uses · Group G0106: Rocke Enterprise uses · Malware S9034: Tsundere Botnet Enterprise uses · Campaign C0057: 3CX Supply Chain Attack Enterprise uses · Campaign C0017: C0017 Enterprise uses · Malware S0069: BLACKCOFFEE Enterprise uses · Malware S0148: RTM Enterprise uses · Group G0096: APT41 Enterprise mitigates · Mitigation M1031: Network Intrusion Prevention Enterprise uses · Malware S0518: PolyglotDuke Enterprise uses · Group G0048: RTM Enterprise uses · Group G0060: BRONZE BUTLER Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1021: Restrict Web-Based Content

Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery. This mitigation can be implemented through the following measures:

Deploy Web Proxy Filtering:

- Use solutions to filter web traffic based on categories, reputation, and content types. - Enforce policies that block unsafe websites or file types at the gateway level.

Enable DNS-Based Filtering:

- Implement tools to restrict access to domains associated with malware or phishing campaigns. - Use public DNS filtering services to enhance protection.

Enforce Content Security Policies (CSP):

- Configure CSP headers on internal and external web applications to restrict script execution, iframe embedding, and cross-origin requests.

Control Browser Features:

- Disable unapproved browser features like automatic downloads, developer tools, or unsafe scripting. - Enforce policies through tools like Group Policy Management to control browser settings.

Monitor and Alert on Web-Based Threats:

- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity. - Configure alerts for access attempts to blocked domains or repeated file download failures.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
a23c5a8ae0001f83...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle a23c5a8ae000…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  2. [2]
    mitre-attack T1102.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use