{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1008","id":"T1008","name":"Fallback Channels","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1008","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"1c1b5c5dbd2c8b374ba1fe240b139df243640c7790b1c0ba57f4d06c56d62f29","description":"Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1008","external_id":"T1008"}],"platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1008","id":"T1008","name":"Fallback Channels","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1008","technique_page":"techniques/enterprise/T1008/","page":"detections/enterprise/T1008/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"8c31f563-f9a7-450c-bfa8-35f8f32f1f61","title":"New Outlook Macro Created","status":"test","level":"medium","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/8c31f563-f9a7-450c-bfa8-35f8f32f1f61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml","author":"@ScoubiMtl","kind":"sigma"},{"id":"117d3d3a-755c-4a61-b23e-9171146d094c","title":"Suspicious Outlook Macro Created","status":"test","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/117d3d3a-755c-4a61-b23e-9171146d094c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"396ae3eb-4174-4b9b-880e-dc0364d78a19","title":"Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/396ae3eb-4174-4b9b-880e-dc0364d78a19.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e3b50fa5-3c3f-444e-937b-0a99d33731cd","title":"Outlook Macro Execution Without Warning Setting Enabled","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/e3b50fa5-3c3f-444e-937b-0a99d33731cd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml","author":"@ScoubiMtl","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0499","name":"Behavioral Detection of Fallback or Alternate C2 Channels","url":"https://attack.mitre.org/detectionstrategies/DET0499","stix_id":"x-mitre-detection-strategy--ee1c44c9-c5aa-4a9c-9e68-49854ed4d602","relationship_id":"relationship--87311c74-f1fe-403e-a646-39fa03ca756a","description":"","analytics":[{"id":"AN1376","name":"Analytic 1376","guidance":"Establishing network connections on uncommon ports or protocols following C2 disruption or blocking. Often executed by processes that typically exhibit no network activity.","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1376","platforms":["Windows"],"tuning":[{"field":"DestinationPort","description":"Can be tuned to include unexpected or high-entropy ports not typically associated with the process."},{"field":"ProcessName","description":"Useful to filter benign applications vs suspicious fallback attempts."},{"field":"DataVolumeRatio","description":"Tunable ratio of sent/received bytes to indicate potential C2 beaconing or exfiltration."},{"field":"TimeWindow","description":"Adjust temporal window to match likely fallback C2 retries after primary channel fails."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1376","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1376","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"uncommon ports","platforms":["Windows"],"analytic_id":"AN1376","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1376","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1377","name":"Analytic 1377","guidance":"Creation of outbound connections on alternate ports or using covert transport (e.g., ICMP, DNS) from non-network-intensive processes, following known disruption or blocked traffic.","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1377","platforms":["Linux"],"tuning":[{"field":"ProtocolType","description":"Can filter for rare fallback channel types (e.g., ICMP, DNS over HTTP)."},{"field":"UserContext","description":"Tuning by user (e.g., root vs. service account) helps suppress noise."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"outbound connections","platforms":["Linux"],"analytic_id":"AN1377","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1377","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"alternate ports","platforms":["Linux"],"analytic_id":"AN1377","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1377","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1378","name":"Analytic 1378","guidance":"Outbound fallback traffic from low-profile or background launch agents using unusual protocols or destinations after primary channel inactivity.","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1378","platforms":["macOS"],"tuning":[{"field":"LaunchAgentContext","description":"Used to suppress known legitimate agents."},{"field":"PayloadEntropy","description":"Can help isolate covert or encrypted fallback traffic."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"macos:unifiedlog","channel":"None","platforms":["macOS"],"analytic_id":"AN1378","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1378","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"None","platforms":["macOS"],"analytic_id":"AN1378","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1378","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1379","name":"Analytic 1379","guidance":"Outbound traffic from host management services or guest-to-host interactions over unusual interfaces (e.g., backdoor API endpoints or external VPN tunnels).","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1379","platforms":["ESXi"],"tuning":[{"field":"InterfaceName","description":"May vary based on ESXi build and should be filtered to suppress known interfaces."},{"field":"FallbackIPRanges","description":"Environment-specific ranges to ignore (e.g., DR tunnels or out-of-band mgmt)."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"esxi:vmkernel","channel":"None","platforms":["ESXi"],"analytic_id":"AN1379","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1379","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"esxi:vpxd","channel":"None","platforms":["ESXi"],"analytic_id":"AN1379","source_url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1379","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0017","name":"BISCUIT","url":"https://attack.mitre.org/software/S0017","kind":"malware","description":"[BISCUIT](https://attack.mitre.org/software/S0017) malware contains a secondary fallback command and control server that is contacted after the primary command and control server.(Citation: Mandiant APT1)(Citation: Mandiant APT1 Appendix)","relationship_id":"relationship--3ac3a282-e1be-45f8-8974-0a94e5d43644","references":[{"source_name":"Mandiant APT1 Appendix","description":"Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"},{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"[Derusbi](https://attack.mitre.org/software/S0021) uses a backup communication method with an HTTP beacon.(Citation: Fidelis Turbo)","relationship_id":"relationship--bd74b90d-ff9f-4ce3-96af-9b809fffc3da","references":[{"source_name":"Fidelis Turbo","description":"Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can use up to 10 channels to communicate between implants.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--a7005b59-48e5-4852-90f7-ed8d2c3698fa","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"[CHOPSTICK](https://attack.mitre.org/software/S0023) can switch to a new C2 channel if the current one is broken.(Citation: ESET Sednit Part 2)","relationship_id":"relationship--101867a2-149c-4088-a90f-7af4b86e5013","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}]},{"id":"S0034","name":"NETEAGLE","url":"https://attack.mitre.org/software/S0034","kind":"malware","description":"[NETEAGLE](https://attack.mitre.org/software/S0034) will attempt to detect if the infected host is configured to a proxy. If so, [NETEAGLE](https://attack.mitre.org/software/S0034) will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.(Citation: FireEye APT30)","relationship_id":"relationship--a713d0d3-2897-4da2-995f-df3a40f04b29","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0044","name":"JHUHUGIT","url":"https://attack.mitre.org/software/S0044","kind":"malware","description":"[JHUHUGIT](https://attack.mitre.org/software/S0044) tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.(Citation: ESET Sednit Part 1)","relationship_id":"relationship--0d43f3a7-70ed-4d04-857e-3a9fbce86cfb","references":[{"source_name":"ESET Sednit Part 1","description":"ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"}]},{"id":"S0051","name":"MiniDuke","url":"https://attack.mitre.org/software/S0051","kind":"malware","description":"[MiniDuke](https://attack.mitre.org/software/S0051) uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.(Citation: Securelist MiniDuke Feb 2013)","relationship_id":"relationship--62c8913c-c193-4feb-ab58-88343838336d","references":[{"source_name":"Securelist MiniDuke Feb 2013","description":"Kaspersky Lab's Global Research & Analysis Team. (2013, February 27). The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20170630181406/https://cdn.securelist.com/files/2014/07/themysteryofthepdf0-dayassemblermicrobackdoor.pdf"}]},{"id":"S0058","name":"SslMM","url":"https://attack.mitre.org/software/S0058","kind":"malware","description":"[SslMM](https://attack.mitre.org/software/S0058) has a hard-coded primary and backup C2 string.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--329678a6-eb6b-499b-90a8-059d1cf1a35f","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0059","name":"WinMM","url":"https://attack.mitre.org/software/S0059","kind":"malware","description":"[WinMM](https://attack.mitre.org/software/S0059) is usually configured with primary and backup domains for C2 communications.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--70a93fc8-83c0-4407-8224-ae447af1235a","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0062","name":"DustySky","url":"https://attack.mitre.org/software/S0062","kind":"malware","description":"[DustySky](https://attack.mitre.org/software/S0062) has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.(Citation: DustySky)","relationship_id":"relationship--b2ab26e2-eb90-4f19-b35a-b8a0a5438961","references":[{"source_name":"DustySky","description":"ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}]},{"id":"S0084","name":"Mis-Type","url":"https://attack.mitre.org/software/S0084","kind":"malware","description":"[Mis-Type](https://attack.mitre.org/software/S0084) first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.(Citation: Cylance Dust Storm)","relationship_id":"relationship--a61cf8cf-87f1-4061-ae9d-31e8162bdfef","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0085","name":"S-Type","url":"https://attack.mitre.org/software/S0085","kind":"malware","description":"[S-Type](https://attack.mitre.org/software/S0085) primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.(Citation: Cylance Dust Storm)","relationship_id":"relationship--4b23ac99-3761-46f0-ad5d-2cf63a95036a","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) has the capability to communicate over a backup channel via plus.google.com.(Citation: Securelist BlackEnergy Nov 2014)","relationship_id":"relationship--f5936bbd-f8cb-404a-bd43-87f7bc836294","references":[{"source_name":"Securelist BlackEnergy Nov 2014","description":"Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}]},{"id":"S0117","name":"XTunnel","url":"https://attack.mitre.org/software/S0117","kind":"malware","description":"The C2 server used by [XTunnel](https://attack.mitre.org/software/S0117) provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.(Citation: ESET Sednit Part 2)","relationship_id":"relationship--e97b39d6-7be1-4f59-8959-7f1f01402152","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}]},{"id":"S0211","name":"Linfo","url":"https://attack.mitre.org/software/S0211","kind":"malware","description":"[Linfo](https://attack.mitre.org/software/S0211) creates a backdoor through which remote attackers can change C2 servers.(Citation: Symantec Linfo May 2012)","relationship_id":"relationship--0fbd4496-f715-4edd-b4da-169d6047a7c9","references":[{"source_name":"Symantec Linfo May 2012","description":"Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) uses a large list of C2 servers that it cycles through until a successful connection is established.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--e2317e9b-9301-4c44-959f-94d66858136c","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) has been configured with several servers available for alternate C2 communications.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--1f728f8c-8aee-4d40-9161-1cae773983d1","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) can accept multiple URLs for C2 servers.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--950399e7-c9c2-4b53-bcc8-b99d0acba8d1","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--3fa8155d-11ca-47de-902e-47e809d0ed64","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0269","name":"QUADAGENT","url":"https://attack.mitre.org/software/S0269","kind":"malware","description":"[QUADAGENT](https://attack.mitre.org/software/S0269) uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.(Citation: Unit 42 QUADAGENT July 2018)","relationship_id":"relationship--dc4bc74b-cd60-4853-a436-8d5e34b01564","references":[{"source_name":"Unit 42 QUADAGENT July 2018","description":"Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) can communicate over multiple C2 host and port combinations.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--d3e0b0b8-797f-4638-bcb6-aa688c3a0a9a","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has multiple C2 channels in place in case one fails.(Citation: US-CERT HOPLIGHT Apr 2019)\t","relationship_id":"relationship--1708aa35-a362-429f-be06-82dc106dfeb4","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0377","name":"Ebury","url":"https://attack.mitre.org/software/S0377","kind":"malware","description":"[Ebury](https://attack.mitre.org/software/S0377) has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.(Citation: ESET Ebury Oct 2017)","relationship_id":"relationship--36849ab3-088c-47a5-bcf9-3e68902a2e60","references":[{"source_name":"ESET Ebury Oct 2017","description":"Vachon, F. (2017, October 30). Windigo Still not Windigone: An Ebury Update . Retrieved February 10, 2021.","url":"https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"}]},{"id":"S0401","name":"Exaramel for Linux","url":"https://attack.mitre.org/software/S0401","kind":"malware","description":"[Exaramel for Linux](https://attack.mitre.org/software/S0401) can attempt to find a new C2 server if it receives an error.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--73a5da20-5358-4da8-8417-020a7dec52cb","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) has sent data over HTTP if FTP failed, and has also used a fallback server.(Citation: ESET Machete July 2019) ","relationship_id":"relationship--bdb7f4c5-3620-479b-af38-95f42e82fb68","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"id":"S0444","name":"ShimRat","url":"https://attack.mitre.org/software/S0444","kind":"malware","description":"[ShimRat](https://attack.mitre.org/software/S0444) has used a secondary C2 location if the first was unavailable.(Citation: FOX-IT May 2016 Mofang)\t","relationship_id":"relationship--a2118212-1594-4fb1-8076-5a8649756c9c","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) can communicate over multiple C2 hosts.(Citation: Unit 42 Valak July 2020)","relationship_id":"relationship--495982e4-9856-4e7f-8e05-4654d67a4d62","references":[{"source_name":"Unit 42 Valak July 2020","description":"Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"id":"S0495","name":"RDAT","url":"https://attack.mitre.org/software/S0495","kind":"malware","description":"[RDAT](https://attack.mitre.org/software/S0495) has used HTTP if DNS C2 communications were not functioning.(Citation: Unit42 RDAT July 2020)\t","relationship_id":"relationship--d96db78c-e7b8-4877-8187-07c5e801cead","references":[{"source_name":"Unit42 RDAT July 2020","description":"Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"[PipeMon](https://attack.mitre.org/software/S0501) can switch to an alternate C2 domain when a particular date has been reached.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--ecca736a-9b3f-4a1d-bdb8-ff5c55197893","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0504","name":"Anchor","url":"https://attack.mitre.org/software/S0504","kind":"malware","description":"[Anchor](https://attack.mitre.org/software/S0504) can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--f9fc4a7b-e8ba-4e50-b97f-9afabcfc73a8","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) has used several C2 servers per targeted organization.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--4e2842c6-ce4c-4204-9f29-4442a1859f12","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) has the ability to use an alternative C2 server if the primary server fails.(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--c1d43be1-daea-4cdd-9632-e0a22f4d9073","references":[{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0538","name":"Crutch","url":"https://attack.mitre.org/software/S0538","kind":"malware","description":"[Crutch](https://attack.mitre.org/software/S0538) has used a hardcoded GitHub repository as a fallback channel.(Citation: ESET Crutch December 2020)","relationship_id":"relationship--d207f54d-81c1-4b20-ba56-575fbdec2f03","references":[{"source_name":"ESET Crutch December 2020","description":"Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}]},{"id":"S0586","name":"TAINTEDSCRIBE","url":"https://attack.mitre.org/software/S0586","kind":"malware","description":"[TAINTEDSCRIBE](https://attack.mitre.org/software/S0586) can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.(Citation: CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020)","relationship_id":"relationship--d2d98eeb-4ebd-4db5-adf8-2a737306b17f","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","description":"USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) has the ability to generate new C2 domains.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--85b5e45d-247e-4c8b-a991-95700e4d81d9","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0610","name":"SideTwist","url":"https://attack.mitre.org/software/S0610","kind":"malware","description":"[SideTwist](https://attack.mitre.org/software/S0610) has primarily used port 443 for C2 but can use port 80 as a fallback.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--abdaccd2-6a3e-4bd2-8fa2-b192f67f22ca","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) can use a second channel for C2 when the primary channel is in upload mode.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--98fc2f95-0c93-405a-a54e-880622d8d233","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) has the ability to switch between TCP and HTTP for C2 if one method is not working.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--8492aff7-1171-4805-9052-3decdd677c94","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can use multiple domains and protocols in C2.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--a01e5280-ae4f-4edd-bb57-e29e8426cc3b","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0668","name":"TinyTurla","url":"https://attack.mitre.org/software/S0668","kind":"malware","description":"[TinyTurla](https://attack.mitre.org/software/S0668) can go through a list of C2 server IPs and will try to register with each until one responds.(Citation: Talos TinyTurla September 2021)","relationship_id":"relationship--b4642810-53c4-4ff2-859f-f4b707a36097","references":[{"source_name":"Talos TinyTurla September 2021","description":"Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--94a1fe68-4c8f-48ca-b186-feca5f800f46","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0699","name":"Mythic","url":"https://attack.mitre.org/software/S0699","kind":"tool","description":"[Mythic](https://attack.mitre.org/software/S0699) can use a list of C2 URLs as fallback mechanisms in case one IP or domain gets blocked.(Citation: Mythc Documentation)\t","relationship_id":"relationship--f1ab6a18-2624-4d35-b9e2-3f3a4288bcac","references":[{"source_name":"Mythc Documentation","description":"Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022.","url":"https://docs.mythic-c2.net/"}]},{"id":"S1019","name":"Shark","url":"https://attack.mitre.org/software/S1019","kind":"malware","description":"[Shark](https://attack.mitre.org/software/S1019) can update its configuration to use a different C2 server.(Citation: ClearSky Siamesekitten August 2021)","relationship_id":"relationship--61952f05-92a3-41e0-93c4-d7486a927ece","references":[{"source_name":"ClearSky Siamesekitten August 2021","description":"ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.","url":"https://www.clearskysec.com/siamesekitten/"}]},{"id":"S1020","name":"Kevin","url":"https://attack.mitre.org/software/S1020","kind":"malware","description":"[Kevin](https://attack.mitre.org/software/S1020) can assign hard-coded fallback domains for C2.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--b921077b-4a62-461c-aaec-9cd70b5cf5f8","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can use backup C2 servers if the primary server fails.(Citation: Proofpoint Bumblebee April 2022)","relationship_id":"relationship--7327153c-c123-401b-b675-554b8070fbed","references":[{"source_name":"Proofpoint Bumblebee April 2022","description":"Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"}]},{"id":"S1084","name":"QUIETEXIT","url":"https://attack.mitre.org/software/S1084","kind":"malware","description":"[QUIETEXIT](https://attack.mitre.org/software/S1084) can attempt to connect to a second hard-coded C2 if the first hard-coded C2 address fails.(Citation: Mandiant APT29 Eye Spy Email Nov 22)","relationship_id":"relationship--550d2a38-7dd8-497d-b65d-43b65a3ec49e","references":[{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","description":"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"id":"S1172","name":"OilBooster","url":"https://attack.mitre.org/software/S1172","kind":"malware","description":"[OilBooster](https://attack.mitre.org/software/S1172) can use a backup channel to request a new refresh token from its C2 server after 10 consecutive unsuccessful connections to the primary OneDrive C2 server.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--e425fe3b-b6a3-4a90-b11c-8b2fbc122f72","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has utilized Google Calendar as backup C2.(Citation: Koi Glassworm InvisibleCode October 2025)(Citation: Koi GlassWorm Rust December 2025)","relationship_id":"relationship--af0ba134-74c9-4256-a48d-6911e98cf235","references":[{"source_name":"Koi Glassworm InvisibleCode October 2025","description":"Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.","url":"https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace"},{"source_name":"Koi GlassWorm Rust December 2025","description":"Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.","url":"https://www.koi.ai/blog/glassworm-goes-native-same-infrastructure-hardened-delivery"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can use active and passive C2 modes that use different encryption algorithms and backdoor commands.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--52ce2f48-1bb7-48f9-8ac6-56002d93672f","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can compress and encrypt data and exfiltrate it via POST to an attacker-controlled domain. If that method fails it can use the victim's own GitHub account to create a public repository and uploads the encrypted data as a release asset.(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)","relationship_id":"relationship--60636234-2547-4139-8f91-e0b984ec5d06","references":[{"source_name":"Aqua Security Trivy Compromise MAR 2026","description":"Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","description":"McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has established Fallback Channels to exfiltrate data to Github when other configured infrastructure is found to be unreachable.(Citation: Wiz Mini Shai-Hulud MAY 2026)(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)","relationship_id":"relationship--bc21fc79-4a67-46e8-b514-efb20e92b3f7","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Wiz Mini Shai-Hulud MAY 2026","description":"McCarthy, R., Cohen, A., and Read, B. (2026, May 12). Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised. Retrieved July 16, 2026.","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","description":"Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"id":"S9063","name":"DEEPROOT","url":"https://attack.mitre.org/software/S9063","kind":"malware","description":"[DEEPROOT](https://attack.mitre.org/software/S9063) has communicated with multiple C2 servers as a means of redundancy if one fails.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--0a04902b-be91-45d9-94de-3ccc3b7c6cbd","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)","relationship_id":"relationship--ab687dca-2741-4920-a71e-e0e0444809c5","references":[{"source_name":"Novetta Blockbuster RATs","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046)'s Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.(Citation: Crowdstrike GTR2020 Mar 2020)","relationship_id":"relationship--dd9f1283-ff4b-4314-b7ce-f326d6932bab","references":[{"source_name":"Crowdstrike GTR2020 Mar 2020","description":"Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.(Citation: OilRig ISMAgent July 2017)","relationship_id":"relationship--12daddcc-b964-485e-8c2d-10f554d78bcc","references":[{"source_name":"OilRig ISMAgent July 2017","description":"Falcone, R. and Lee, B. (2017, July 27). OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group. Retrieved January 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/07/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used the Steam community page as a fallback mechanism for C2.(Citation: FireEye APT41 Aug 2019) ","relationship_id":"relationship--97775c58-7cb1-46e0-9504-e60a459e44d0","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--f96e840a-b41b-4238-a664-db6fa5bf0c22","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]}],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)","relationship_id":"relationship--1469ff36-c655-4513-8ffa-81dcb55c4ae6","references":[{"source_name":"University of Birmingham C2","description":"Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.","url":"https://arxiv.org/pdf/1408.1136"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1008":"/ttp-simulation/techniques/enterprise/T1008/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1008","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}