Description
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
Platforms
Mitigations (1)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions
Threat Groups (5)
| ID | Group | Context |
|---|---|---|
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used the Steam community page as a fallback mechanism for C2.(Citation: FireEye APT41 Aug 2019) |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046)'s Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.(Citation: Crowdstrike GTR... |
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has employed layers of redundancy to maintain access to compromised environments including network de... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over... |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the ... |
Associated Software (51)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) can use secondary C2 servers for communication after establishing connectivity and relaying victim... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can use backup C2 servers if the primary server fails.(Citation: Proofpoint Bumblebee April 2022) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) has the ability to generate new C2 domains.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien F... |
| S0401 | Exaramel for Linux | Malware | [Exaramel for Linux](https://attack.mitre.org/software/S0401) can attempt to find a new C2 server if it receives an error.(Citation: ANSSI Sandworm Ja... |
| S0059 | WinMM | Malware | [WinMM](https://attack.mitre.org/software/S0059) is usually configured with primary and backup domains for C2 communications.(Citation: Baumgartner Na... |
| S0629 | RainyDay | Malware | [RainyDay](https://attack.mitre.org/software/S0629) has the ability to switch between TCP and HTTP for C2 if one method is not working.(Citation: Bitd... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) can use a second channel for C2 when the primary channel is in upload mode.(Citation: Malwarebyte... |
| S0668 | TinyTurla | Malware | [TinyTurla](https://attack.mitre.org/software/S0668) can go through a list of C2 server IPs and will try to register with each until one responds.(Cit... |
| S0058 | SslMM | Malware | [SslMM](https://attack.mitre.org/software/S0058) has a hard-coded primary and backup C2 string.(Citation: Baumgartner Naikon 2015) |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) has sent data over HTTP if FTP failed, and has also used a fallback server.(Citation: ESET Machete ... |
| S0376 | HOPLIGHT | Malware | [HOPLIGHT](https://attack.mitre.org/software/S0376) has multiple C2 channels in place in case one fails.(Citation: US-CERT HOPLIGHT Apr 2019) |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) has been configured with several servers available for alternate C2 communications.(Citation: ES... |
| S1084 | QUIETEXIT | Malware | [QUIETEXIT](https://attack.mitre.org/software/S1084) can attempt to connect to a second hard-coded C2 if the first hard-coded C2 address fails.(Citati... |
| S0495 | RDAT | Malware | [RDAT](https://attack.mitre.org/software/S0495) has used HTTP if DNS C2 communications were not functioning.(Citation: Unit42 RDAT July 2020) |
| S0265 | Kazuar | Malware | [Kazuar](https://attack.mitre.org/software/S0265) can accept multiple URLs for C2 servers.(Citation: Unit 42 Kazuar May 2017) |
| S0034 | NETEAGLE | Malware | [NETEAGLE](https://attack.mitre.org/software/S0034) will attempt to detect if the infected host is configured to a proxy. If so, [NETEAGLE](https://at... |
| S0512 | FatDuke | Malware | [FatDuke](https://attack.mitre.org/software/S0512) has used several C2 servers per targeted organization.(Citation: ESET Dukes October 2019) |
| S0089 | BlackEnergy | Malware | [BlackEnergy](https://attack.mitre.org/software/S0089) has the capability to communicate over a backup channel via plus.google.com.(Citation: Secureli... |
| S0444 | ShimRat | Malware | [ShimRat](https://attack.mitre.org/software/S0444) has used a secondary C2 location if the first was unavailable.(Citation: FOX-IT May 2016 Mofang) |
| S0051 | MiniDuke | Malware | [MiniDuke](https://attack.mitre.org/software/S0051) uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.(Cit... |
References
Frequently Asked Questions
What is T1008 (Fallback Channels)?
T1008 is a MITRE ATT&CK technique named 'Fallback Channels'. It belongs to the Command and Control tactic(s). Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thre...
How can T1008 be detected?
Detection of T1008 (Fallback Channels) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1008?
There are 1 documented mitigations for T1008. Key mitigations include: Network Intrusion Prevention.
Which threat groups use T1008?
Known threat groups using T1008 include: APT41, FIN7, UNC3886, OilRig, Lazarus Group.