Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1104: Multi-Stage Channels

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.

The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.

EnterpriseT1104TechniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Multi-Stage Channels matter because an initial callback may only be the entry point, not the attacker’s real operating channel. For leaders, this means blocking or investigating one command-and-control path may not end the incident: the host may be redirected to separate infrastructure, receive a more capable RAT, or use backup callbacks. The practical risk is delayed containment and incomplete scoping across Linux, macOS, Windows, and ESXi environments.

Executive priority

Prioritize this as an incident-readiness and resilience issue. Ask whether SOC and IR teams can follow a suspected C2 event across stages: first callback, host profiling, tool update, file upload, second payload, and later reverse-shell/RAT activity. Budget and control decisions should emphasize network boundary monitoring/prevention, endpoint and server telemetry retention, and evidence that containment playbooks account for fallback or non-overlapping infrastructure.

Technical view

ATT&CK provides no official detection text for T1104, but the relationship context includes detection strategy DET0228, Detect Multi-Stage Command and Control Channels, and mitigation M1031, Network Intrusion Prevention. Detection engineering should validate correlation across separate outbound destinations, sequential payload retrieval, tool updates, file uploads, and later interactive C2 behavior. IR teams should avoid treating a single blocked callback as full containment; scope for backup first-stage callbacks, second-stage RAT installation, and reverse-shell activity across supported platforms.

Likely telemetry

  • Network connection logs and proxy/firewall records for outbound callbacks
  • IDS/IPS alerts and network boundary traffic metadata
  • DNS resolution history associated with changing or staged infrastructure
  • Endpoint process, file creation, and module/tool update activity
  • File upload/download evidence from hosts initiating C2

Detection direction

  • Validate whether DET0228-style logic is implemented: correlation of multiple C2 stages rather than single-domain or single-IP matching.
  • Tune for sequences: initial low-volume callback, host information collection, additional file transfer, then new outbound destination or more interactive RAT behavior.
  • Review false positives from legitimate software updaters, remote administration tools, deployment systems, and backup agents that may also contact multiple services in stages.
  • Check blind spots where proxy, DNS, endpoint, or ESXi telemetry is missing or retained too briefly to connect first-stage and second-stage activity.
  • Use relationship context carefully: multiple groups and malware families are mapped to this technique, but those mappings should guide threat-informed testing, not assumptions of attribution.

Mitigation priorities

  • Start with network intrusion prevention at boundaries as identified by M1031, using signatures or rules to block known malicious traffic where available.
  • Pair blocking with investigation workflows that search for secondary callbacks and downloaded tools after the first indicator is contained.
  • Harden and monitor remote access paths and outbound connectivity from servers, endpoints, and ESXi assets according to business need.
  • Maintain telemetry retention long enough to reconstruct staged C2 timelines across network and endpoint sources.
  • Use threat-informed exercises based on the mapped software and campaign relationships to test whether SOC playbooks detect multi-stage behavior without relying only on known indicators.
Analyst notes and limits

Mapped relationships include campaign, group, software, detection strategy, and mitigation context, including examples such as Valak, Bazar, Latrodectus, LunarWeb, Uroburos, and others. These relationships show the technique’s relevance across different malware ecosystems, but they do not prove current activity in any specific environment.

The supplied ATT&CK object does not include official detection analytics, data sources, or procedural details for each relationship. Local conclusions require environment-specific telemetry, asset inventory, allowed outbound traffic baselines, and incident evidence. No active exploitation, customer exposure, or guaranteed detection coverage is implied.

Official MITRE ATT&CK definition

Multi-Stage Channels

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.

The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0022: APT3

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

Group Enterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

Malware Enterprise

S0476: Valak

Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.[1][2]

Windows
Malware Enterprise

S1206: JumbledPath

JumbledPath is a custom-built utility written in GO that has been used by Salt Typhoon since at least 2024 for packet capture on remote Cisco devices. JumbledPath is compiled as an ELF binary using x86-64 architecture which makes it potentially useable across Linux operating systems and network devices from multiple vendors.[1]

Network Devices
Malware Enterprise

S0534: Bazar

Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.[1]

Windows
Malware Enterprise

S1160: Latrodectus

Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.[1][2][3]

Windows
Malware Enterprise

S0022: Uroburos

Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.[1][2]

LinuxWindowsmacOS
Malware Enterprise

S0220: Chaos

Chaos is Linux malware that compromises systems by brute force attacks against SSH services. Once installed, it provides a reverse shell to its controllers, triggered by unsolicited packets. [1]

Linux
Campaign Enterprise

C0056: RedPenguin

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]

Relationship explorer

All related ATT&CK context

uses · Group G0022: APT3 Enterprise uses · Malware S1141: LunarWeb Enterprise uses · Malware S0069: BLACKCOFFEE Enterprise uses · Campaign C0056: RedPenguin Enterprise mitigates · Mitigation M1031: Network Intrusion Prevention Enterprise uses · Group G0032: Lazarus Group Enterprise uses · Malware S0476: Valak Enterprise detects · Detection Strategy DET0228: Detect Multi-Stage Command and Control Channels Enterprise uses · Malware S1206: JumbledPath Enterprise uses · Malware S0534: Bazar Enterprise uses · Malware S1086: Snip3 Enterprise uses · Malware S1160: Latrodectus Enterprise uses · Malware S0022: Uroburos Enterprise uses · Group G0069: MuddyWater Enterprise uses · Malware S0031: BACKSPACE Enterprise uses · Malware S0220: Chaos Enterprise uses · Group G0096: APT41 Enterprise
Mitigations

Mitigation direction

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
11580bf678f75d45...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle 11580bf678f7…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    mitre-attack T1104
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use