Description
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Platforms
Mitigations (2)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Restrict Web-Based ContentM1021
Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.
Threat Groups (16)
| ID | Group | Context |
|---|---|---|
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used Blogspot pages and a Github repository for C2.(Citation: Talos Kimsuky Nov 2021)(Citation: Z... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used web services including OneHub to distribute remote access tools.(Citation: Anomali Static... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used several ways to try to resolve the C2 server, including: public third-party websites... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.(Citation: FireEye FIN7 A... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Pytho... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary com... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has communicated with C2 through files uploaded to and downloaded from DropBox.(Citation: BitDefender C... |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067) leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox... |
| G0008 | Carbanak | [Carbanak](https://attack.mitre.org/groups/G0008) has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.(C... |
| G1005 | POLONIUM | [POLONIUM](https://attack.mitre.org/groups/G1005) has used OneDrive and DropBox for C2.(Citation: Microsoft POLONIUM June 2022) |
| G0010 | Turla | A [Turla](https://attack.mitre.org/groups/G0010) JavaScript backdoor has used Google Apps Script as its C2 server.(Citation: ESET Turla Mosquito Jan 2... |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) has used Google Drive for C2.(Citation: TrendMicro Pawn Storm Dec 2020) |
| G0005 | APT12 | [APT12](https://attack.mitre.org/groups/G0005) has used blogs and WordPress for C2 infrastructure.(Citation: Meyers Numbered Panda) |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) has used GitHub as C2, pulling hosted image payloads then committing command execution output t... |
| G1001 | HEXANE | [HEXANE](https://attack.mitre.org/groups/G1001) has used cloud services, including OneDrive, for C2.(Citation: Microsoft POLONIUM June 2022) |
| G0059 | Magic Hound | [Magic Hound](https://attack.mitre.org/groups/G0059) malware can use a SOAP Web service to communicate with its C2 server.(Citation: Unit 42 Magic Hou... |
Associated Software (38)
| ID | Name | Type | Context |
|---|---|---|---|
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) has used Technet and Pastebin web pages for command and control.(Citation: Proofpoint Leviathan Oct 201... |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) communicates to the C2 server by retrieving a Google Doc.(Citation: ASERT Donot March 2018) |
| S0213 | DOGCALL | Malware | [DOGCALL](https://attack.mitre.org/software/S0213) is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.(Citatio... |
| S0042 | LOWBALL | Malware | [LOWBALL](https://attack.mitre.org/software/S0042) uses the Dropbox cloud storage service for command and control.(Citation: FireEye admin@338) |
| S0215 | KARAE | Malware | [KARAE](https://attack.mitre.org/software/S0215) can use public cloud-based storage providers for command and control.(Citation: FireEye APT37 Feb 201... |
| S0218 | SLOWDRIFT | Malware | [SLOWDRIFT](https://attack.mitre.org/software/S0218) uses cloud based services for C2.(Citation: FireEye APT37 Feb 2018) |
| S1170 | ODAgent | Malware | [ODAgent](https://attack.mitre.org/software/S1170) can use the Microsoft Graph API to access an attacker-controlled OneDrive account and retrieve payl... |
| S0511 | RegDuke | Malware | [RegDuke](https://attack.mitre.org/software/S0511) can use Dropbox as its C2 server.(Citation: ESET Dukes October 2019) |
| S1201 | TRANSLATEXT | Malware | [TRANSLATEXT](https://attack.mitre.org/software/S1201) has used a Github repository for C2.(Citation: Zscaler Kimsuky TRANSLATEXT) |
| S0333 | UBoatRAT | Malware | [UBoatRAT](https://attack.mitre.org/software/S0333) has used GitHub and a public blog service in Hong Kong for C2 communications.(Citation: PaloAlto U... |
| S0265 | Kazuar | Malware | [Kazuar](https://attack.mitre.org/software/S0265) has used compromised WordPress blogs as C2 servers.(Citation: Unit 42 Kazuar May 2017) |
| S0216 | POORAIM | Malware | [POORAIM](https://attack.mitre.org/software/S0216) has used AOL Instant Messenger for C2.(Citation: FireEye APT37 Feb 2018) |
| S0025 | CALENDAR | Malware | The [CALENDAR](https://attack.mitre.org/software/S0025) malware communicates through the use of events in Google Calendar.(Citation: Mandiant APT1)(Ci... |
| S0240 | ROKRAT | Malware | [ROKRAT](https://attack.mitre.org/software/S0240) has used legitimate social networking sites and cloud platforms (including but not limited to Twitte... |
| S0660 | Clambling | Malware | [Clambling](https://attack.mitre.org/software/S0660) can use Dropbox to download malicious payloads, send commands, and receive information.(Citation:... |
| S1023 | CreepyDrive | Malware | [CreepyDrive](https://attack.mitre.org/software/S1023) can use OneDrive for C2.(Citation: Microsoft POLONIUM June 2022) |
| S1210 | Sagerunex | Malware | [Sagerunex](https://attack.mitre.org/software/S1210) has used virtual private servers (VPS) for command and control traffic as well as third-party clo... |
| S0657 | BLUELIGHT | Malware | [BLUELIGHT](https://attack.mitre.org/software/S0657) can use different cloud providers for its C2.(Citation: Volexity InkySquid BLUELIGHT August 2021) |
| S0270 | RogueRobin | Malware | [RogueRobin](https://attack.mitre.org/software/S0270) has used Google Drive as a Command and Control channel. (Citation: Unit42 DarkHydrus Jan 2019) |
| S0651 | BoxCaon | Malware | [BoxCaon](https://attack.mitre.org/software/S0651) has used DropBox for C2 communications.(Citation: Checkpoint IndigoZebra July 2021) |
References
Frequently Asked Questions
What is T1102.002 (Bidirectional Communication)?
T1102.002 is a MITRE ATT&CK technique named 'Bidirectional Communication'. It belongs to the Command and Control tactic(s). Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may...
How can T1102.002 be detected?
Detection of T1102.002 (Bidirectional Communication) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1102.002?
There are 2 documented mitigations for T1102.002. Key mitigations include: Network Intrusion Prevention, Restrict Web-Based Content.
Which threat groups use T1102.002?
Known threat groups using T1102.002 include: Kimsuky, MuddyWater, Gamaredon Group, FIN7, Sandworm Team, ZIRCONIUM, APT39, APT37.