T1104: Multi-Stage Channels
Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.
Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.
The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.
Security context for executives and security teams
Multi-Stage Channels matter because an initial callback may only be the entry point, not the attacker’s real operating channel. For leaders, this means blocking or investigating one command-and-control path may not end the incident: the host may be redirected to separate infrastructure, receive a more capable RAT, or use backup callbacks. The practical risk is delayed containment and incomplete scoping across Linux, macOS, Windows, and ESXi environments.
Executive priority
Prioritize this as an incident-readiness and resilience issue. Ask whether SOC and IR teams can follow a suspected C2 event across stages: first callback, host profiling, tool update, file upload, second payload, and later reverse-shell/RAT activity. Budget and control decisions should emphasize network boundary monitoring/prevention, endpoint and server telemetry retention, and evidence that containment playbooks account for fallback or non-overlapping infrastructure.
Technical view
ATT&CK provides no official detection text for T1104, but the relationship context includes detection strategy DET0228, Detect Multi-Stage Command and Control Channels, and mitigation M1031, Network Intrusion Prevention. Detection engineering should validate correlation across separate outbound destinations, sequential payload retrieval, tool updates, file uploads, and later interactive C2 behavior. IR teams should avoid treating a single blocked callback as full containment; scope for backup first-stage callbacks, second-stage RAT installation, and reverse-shell activity across supported platforms.
Likely telemetry
- Network connection logs and proxy/firewall records for outbound callbacks
- IDS/IPS alerts and network boundary traffic metadata
- DNS resolution history associated with changing or staged infrastructure
- Endpoint process, file creation, and module/tool update activity
- File upload/download evidence from hosts initiating C2
Detection direction
- Validate whether DET0228-style logic is implemented: correlation of multiple C2 stages rather than single-domain or single-IP matching.
- Tune for sequences: initial low-volume callback, host information collection, additional file transfer, then new outbound destination or more interactive RAT behavior.
- Review false positives from legitimate software updaters, remote administration tools, deployment systems, and backup agents that may also contact multiple services in stages.
- Check blind spots where proxy, DNS, endpoint, or ESXi telemetry is missing or retained too briefly to connect first-stage and second-stage activity.
- Use relationship context carefully: multiple groups and malware families are mapped to this technique, but those mappings should guide threat-informed testing, not assumptions of attribution.
Mitigation priorities
- Start with network intrusion prevention at boundaries as identified by M1031, using signatures or rules to block known malicious traffic where available.
- Pair blocking with investigation workflows that search for secondary callbacks and downloaded tools after the first indicator is contained.
- Harden and monitor remote access paths and outbound connectivity from servers, endpoints, and ESXi assets according to business need.
- Maintain telemetry retention long enough to reconstruct staged C2 timelines across network and endpoint sources.
- Use threat-informed exercises based on the mapped software and campaign relationships to test whether SOC playbooks detect multi-stage behavior without relying only on known indicators.
Additional notes and limits
Mapped relationships include campaign, group, software, detection strategy, and mitigation context, including examples such as Valak, Bazar, Latrodectus, LunarWeb, Uroburos, and others. These relationships show the technique’s relevance across different malware ecosystems, but they do not prove current activity in any specific environment.
The supplied ATT&CK object does not include official detection analytics, data sources, or procedural details for each relationship. Local conclusions require environment-specific telemetry, asset inventory, allowed outbound traffic baselines, and incident evidence. No active exploitation, customer exposure, or guaranteed detection coverage is implied.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Multi-Stage Channels
Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.
Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.
The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0022: APT3
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
G0069: MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
S1141: LunarWeb
LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.[1]
S0069: BLACKCOFFEE
BLACKCOFFEE is malware that has been used by several Chinese groups since at least 2013. [1] [2]
S0476: Valak
S1206: JumbledPath
JumbledPath is a custom-built utility written in GO that has been used by Salt Typhoon since at least 2024 for packet capture on remote Cisco devices. JumbledPath is compiled as an ELF binary using x86-64 architecture which makes it potentially useable across Linux operating systems and network devices from multiple vendors.[1]
S0534: Bazar
Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.[1]
S1086: Snip3
Snip3 is a sophisticated crypter-as-a-service that has been used since at least 2021 to obfuscate and load numerous strains of malware including AsyncRAT, Revenge RAT, Agent Tesla, and NETWIRE.[1][2]
S1160: Latrodectus
Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.[1][2][3]
S0022: Uroburos
Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.[1][2]
S0031: BACKSPACE
S0220: Chaos
C0056: RedPenguin
The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 11580bf678f7… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]FireEye Operation Double Tap
Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
Open source URL - [2]ESET Turla Lunar toolset May 2024
Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
Open source URL - [3]FireEye APT17
FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.
Open source URL - [4]Mandiant UNC3886 Juniper Routers MAR 2025
Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.
Open source URL - [5]Lazarus APT January 2022
Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.
Open source URL - [6]Unit 42 Valak July 2020
Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
Open source URL - [7]Cisco Salt Typhoon FEB 2025
Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.
Open source URL - [8]Cybereason Bazar July 2020
Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
Open source URL - [9]Zscaler Bazar September 2020
Sadique, M. and Singh, A. (2020, September 29). Spear Phishing Campaign Delivers Buer and Bazar Malware. Retrieved November 19, 2020.
Open source URL - [10]Morphisec Snip3 May 2021
Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.
Open source URL - [11]Telefonica Snip3 December 2021
Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.
Open source URL - [12]Latrodectus APR 2024
Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.
Open source URL - [13]Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023
FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
Open source URL - [14]Talos MuddyWater May 2019
Adamitis, D. et al. (2019, May 20). Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques. Retrieved June 5, 2019.
Open source URL - [15]FireEye APT30
FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.
Open source URL - [16]Chaos Stolen Backdoor
Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.
- [17]FireEye APT41 March 2020
Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.
Open source URL - [18]mitre-attackT1104Open source URL
- [19]mitre-attackT1104Open source URL
- [20]mitre-attackT1104Open source URL
- [21]FireEye Operation Double Tap
Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
Open source URL - [22]ESET Turla Lunar toolset May 2024
Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
Open source URL - [23]FireEye APT17
FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.
Open source URL - [24]Mandiant UNC3886 Juniper Routers MAR 2025
Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.
Open source URL - [25]Lazarus APT January 2022
Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.
Open source URL - [26]Unit 42 Valak July 2020
Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
Open source URL - [27]Cisco Salt Typhoon FEB 2025
Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.
Open source URL - [28]Cybereason Bazar July 2020
Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
Open source URL - [29]Zscaler Bazar September 2020
Sadique, M. and Singh, A. (2020, September 29). Spear Phishing Campaign Delivers Buer and Bazar Malware. Retrieved November 19, 2020.
Open source URL - [30]Morphisec Snip3 May 2021
Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.
Open source URL - [31]Telefonica Snip3 December 2021
Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.
Open source URL - [32]Latrodectus APR 2024
Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.
Open source URL - [33]Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023
FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
Open source URL - [34]Talos MuddyWater May 2019
Adamitis, D. et al. (2019, May 20). Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques. Retrieved June 5, 2019.
Open source URL - [35]FireEye APT30
FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.
Open source URL - [36]Chaos Stolen Backdoor
Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.