T1102.003: One-Way Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Security context for executives and security teams
One-Way Communication is a command-and-control behavior where a compromised system retrieves instructions from a legitimate external web service, such as a popular website or social media platform, without sending command output back through that same service. This matters because the traffic can blend into normal business web activity and may be protected by SSL/TLS, making simple domain blocking or perimeter monitoring insufficient.
Executive priority
Treat this as an egress visibility and web-governance issue, not only a malware issue. Leaders should ask whether the organization can distinguish approved business use of common web services from unusual command retrieval by servers, workstations, ESXi systems, or other in-scope platforms. Priority should go to validating web proxy controls, network intrusion prevention at boundaries, and audit-ready evidence that exceptions to popular external services are intentional and monitored.
Technical view
For SOC, detection engineering, and IR teams, the key validation is whether one-way command retrieval can be observed when no obvious response occurs on the same channel. ATT&CK provides no official detection text for this sub-technique, but the related detection strategy DET0581, Detect One-Way Web Service Command Channels, indicates that monitoring should focus on suspicious command-channel patterns over legitimate web services. Analysts should correlate web service access with endpoint process context, host role, timing, and whether any separate C2 or exfiltration path appears after command retrieval. Relationship context shows this behavior is used by multiple ATT&CK-listed groups, campaigns, and software families, so coverage should be threat-informed but locally tested.
Likely telemetry
- Web proxy and URL filtering logs for access to common web services, social media, and cloud-hosted content
- DNS queries and resolutions for external web services
- Firewall, IDS, and IPS logs at network boundaries
- TLS metadata such as SNI, certificate details, destination IPs, and connection timing where available
- Endpoint process-to-network telemetry on Linux, macOS, Windows, and ESXi systems
Detection direction
- Validate DET0581-style analytics against legitimate web service traffic rather than relying only on known-bad domains.
- Baseline which hosts and users normally access popular web and social platforms; prioritize anomalies from servers, administrative systems, ESXi environments, or non-browser processes.
- Look for periodic or scripted retrieval from external web content with little or no same-channel response traffic.
- Correlate suspected one-way web-service access with later activity over a different network channel, since command output may be returned elsewhere or not at all.
- Tune carefully for false positives from normal browser use, software updates, collaboration tools, and sanctioned cloud services.
Mitigation priorities
- Use M1021 Restrict Web-Based Content as the primary control direction: enforce policy-driven access to web services, URL categories, downloads, scripts, and browser behaviors.
- Document and review business exceptions for popular external services so defenders know which access is expected.
- Use M1031 Network Intrusion Prevention to apply intrusion detection or blocking signatures at network boundaries where applicable.
- Prioritize egress monitoring and control for high-value systems and platforms listed for this technique: Linux, macOS, Windows, and ESXi.
- Ensure SOC runbooks include escalation paths for suspicious legitimate-service C2 patterns, especially when command output is absent or appears to use another channel.
Additional notes and limits
The material risk is the abuse of trusted web services as cover for C2. The relationship set includes ATT&CK-listed campaigns, groups, and software that use this sub-technique, including ArcaneDoor, Gamaredon Group, Leviathan, HAMMERTOSS, OnionDuke, Metamorfo, EVILNUM, UPSTYLE, and Sagerunex; these relationships should inform threat modeling without implying current exposure in any specific environment.
ATT&CK does not provide official detection guidance for this object, and the supplied fields do not provide concrete indicators, signatures, or active exploitation claims. Local asset roles, approved web-service usage, proxy architecture, TLS inspection policy, and endpoint telemetry availability will determine practical coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
One-Way Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1102 | Web Service | This object subtechnique of Web Service. |
Groups, software, and campaigns
G0065: Leviathan
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
S0568: EVILNUM
S1210: Sagerunex
Sagerunex is a malware family exclusively associated with Lotus Blossom operations, with variants existing since at least 2016. Variations of Sagerunex leverage non-traditional command and control mechanisms such as various web services.[1][2]
S0455: Metamorfo
S0052: OnionDuke
S1164: UPSTYLE
S0037: HAMMERTOSS
HAMMERTOSS is a backdoor that was used by APT29 in 2015. [1] [2]
C0046: ArcaneDoor
ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.[1][2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | bd9ffaa6568d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Cisco ArcaneDoor 2024
Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.
Open source URL - [2]Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL - [3]FireEye Periscope March 2018
FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
Open source URL - [4]unit42_gamaredon_dec2022
Unit 42. (2022, December 20). Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine. Retrieved September 12, 2024.
Open source URL - [5]Cisco LotusBlossom 2025
Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.
Open source URL - [6]Medium Metamorfo Apr 2020
Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
Open source URL - [7]FireEye Metamorfo Apr 2018
Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.
Open source URL - [8]Fortinet Metamorfo Feb 2020
Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.
Open source URL - [9]F-Secure The Dukes
F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
Open source URL - [10]Volexity UPSTYLE 2024
Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.
Open source URL - [11]FireEye APT29
FireEye Labs. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved November 17, 2024.
Open source URL - [12]University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL - [13]University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL - [14]University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL - [15]mitre-attackT1102.003Open source URL
- [16]mitre-attackT1102.003Open source URL
- [17]mitre-attackT1102.003Open source URL
- [18]Cisco ArcaneDoor 2024
Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.
Open source URL - [19]Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL - [20]FireEye Periscope March 2018
FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
Open source URL - [21]unit42_gamaredon_dec2022
Unit 42. (2022, December 20). Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine. Retrieved September 12, 2024.
Open source URL - [22]Cisco LotusBlossom 2025
Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.
Open source URL - [23]FireEye Metamorfo Apr 2018
Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.
Open source URL - [24]Fortinet Metamorfo Feb 2020
Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.
Open source URL - [25]Medium Metamorfo Apr 2020
Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
Open source URL - [26]F-Secure The Dukes
F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
Open source URL - [27]Volexity UPSTYLE 2024
Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.
Open source URL - [28]FireEye APT29
FireEye Labs. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved November 17, 2024.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.