Description
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Platforms
Mitigations (2)
Restrict Web-Based ContentM1021
Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Threat Groups (16)
| ID | Group | Context |
|---|---|---|
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used Blogspot pages and a Github repository for C2.(Citation: Talos Kimsuky Nov 2021)(Citation: Z... |
| G1005 | POLONIUM | [POLONIUM](https://attack.mitre.org/groups/G1005) has used OneDrive and DropBox for C2.(Citation: Microsoft POLONIUM June 2022) |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067) leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox... |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) has used GitHub as C2, pulling hosted image payloads then committing command execution output t... |
| G0005 | APT12 | [APT12](https://attack.mitre.org/groups/G0005) has used blogs and WordPress for C2 infrastructure.(Citation: Meyers Numbered Panda) |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has communicated with C2 through files uploaded to and downloaded from DropBox.(Citation: BitDefender C... |
| G0059 | Magic Hound | [Magic Hound](https://attack.mitre.org/groups/G0059) malware can use a SOAP Web service to communicate with its C2 server.(Citation: Unit 42 Magic Hou... |
| G0010 | Turla | A [Turla](https://attack.mitre.org/groups/G0010) JavaScript backdoor has used Google Apps Script as its C2 server.(Citation: ESET Turla Mosquito Jan 2... |
| G1001 | HEXANE | [HEXANE](https://attack.mitre.org/groups/G1001) has used cloud services, including OneDrive, for C2.(Citation: Microsoft POLONIUM June 2022) |
| G0008 | Carbanak | [Carbanak](https://attack.mitre.org/groups/G0008) has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.(C... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.(Citation: FireEye FIN7 A... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Pytho... |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) has used Google Drive for C2.(Citation: TrendMicro Pawn Storm Dec 2020) |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used web services including OneHub to distribute remote access tools.(Citation: Anomali Static... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary com... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used several ways to try to resolve the C2 server, including: public third-party websites... |
Associated Software (38)
| ID | Name | Type | Context |
|---|---|---|---|
| S0393 | PowerStallion | Malware | [PowerStallion](https://attack.mitre.org/software/S0393) uses Microsoft OneDrive as a C2 server via a network drive mapped with <code>net use</code>.(... |
| S0651 | BoxCaon | Malware | [BoxCaon](https://attack.mitre.org/software/S0651) has used DropBox for C2 communications.(Citation: Checkpoint IndigoZebra July 2021) |
| S1222 | RIFLESPINE | Malware | [RIFLESPINE](https://attack.mitre.org/software/S1222) can retrieve C2 commands from an encrypted file on Google Drive then upload the results of comma... |
| S0538 | Crutch | Malware | [Crutch](https://attack.mitre.org/software/S0538) can use Dropbox to receive commands and upload stolen data.(Citation: ESET Crutch December 2020) |
| S0660 | Clambling | Malware | [Clambling](https://attack.mitre.org/software/S0660) can use Dropbox to download malicious payloads, send commands, and receive information.(Citation:... |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) has used Technet and Pastebin web pages for command and control.(Citation: Proofpoint Leviathan Oct 201... |
| S0025 | CALENDAR | Malware | The [CALENDAR](https://attack.mitre.org/software/S0025) malware communicates through the use of events in Google Calendar.(Citation: Mandiant APT1)(Ci... |
| S0046 | CozyCar | Malware | [CozyCar](https://attack.mitre.org/software/S0046) uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.(Citati... |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) communicates to the C2 server by retrieving a Google Doc.(Citation: ASERT Donot March 2018) |
| S0218 | SLOWDRIFT | Malware | [SLOWDRIFT](https://attack.mitre.org/software/S0218) uses cloud based services for C2.(Citation: FireEye APT37 Feb 2018) |
| S1170 | ODAgent | Malware | [ODAgent](https://attack.mitre.org/software/S1170) can use the Microsoft Graph API to access an attacker-controlled OneDrive account and retrieve payl... |
| S0531 | Grandoreiro | Malware | [Grandoreiro](https://attack.mitre.org/software/S0531) can utilize web services including Google sites to send and receive C2 data.(Citation: IBM Gran... |
| S0244 | Comnie | Malware | [Comnie](https://attack.mitre.org/software/S0244) uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of thei... |
| S0128 | BADNEWS | Malware | [BADNEWS](https://attack.mitre.org/software/S0128) can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.(Citation: Forcepoint ... |
| S1168 | SampleCheck5000 | Malware | [SampleCheck5000](https://attack.mitre.org/software/S1168) can use the Microsoft Office Exchange Web Services API to access an actor-controlled accoun... |
| S0333 | UBoatRAT | Malware | [UBoatRAT](https://attack.mitre.org/software/S0333) has used GitHub and a public blog service in Hong Kong for C2 communications.(Citation: PaloAlto U... |
| S1023 | CreepyDrive | Malware | [CreepyDrive](https://attack.mitre.org/software/S1023) can use OneDrive for C2.(Citation: Microsoft POLONIUM June 2022) |
| S0054 | CloudDuke | Malware | One variant of [CloudDuke](https://attack.mitre.org/software/S0054) uses a Microsoft OneDrive account to exchange commands and stolen data with its op... |
| S0126 | ComRAT | Malware | [ComRAT](https://attack.mitre.org/software/S0126) has the ability to use the Gmail web UI to receive commands and exfiltrate information.(Citation: ES... |
| S1172 | OilBooster | Malware | [OilBooster](https://attack.mitre.org/software/S1172) uses the Microsoft Graph API to connect to an actor-controlled OneDrive account to download and ... |
References
Frequently Asked Questions
What is T1102.002 (Bidirectional Communication)?
T1102.002 is a MITRE ATT&CK technique named 'Bidirectional Communication'. It belongs to the Command and Control tactic(s). Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may...
How can T1102.002 be detected?
Detection of T1102.002 (Bidirectional Communication) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1102.002?
There are 2 documented mitigations for T1102.002. Key mitigations include: Restrict Web-Based Content, Network Intrusion Prevention.
Which threat groups use T1102.002?
Known threat groups using T1102.002 include: Kimsuky, POLONIUM, APT37, Lazarus Group, APT12, APT39, Magic Hound, Turla.