aol.pm

Dead Drop Resolver

Subtechnique · ATTACK:enterprise:T1102.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1102.001",
  "title": "Dead Drop Resolver",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1102/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f7827069-0bf2-4764-af4f-23fae0d181b7",
  "external_id": "T1102.001",
  "domain": "enterprise",
  "created": "2020-03-14T22:24:21.841Z",
  "modified": "2026-09-11T19:23:51.161Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Dead Drop Resolver",
      "url": "https://www.sycope.com/post/dictionary-item/dead-drop-resolver"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00914655-1a22-40ed-ae4d-6adb1a6acd35

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c870326-6b8a-4279-bbd3-2c1ae23ba54a

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13111e18-5f34-4925-ba0d-655a1fedeb52

Mandiant APT41

ATTACK:enterprise:S0051 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f972385-7f1c-4cbd-a071-951973e6d229

F-Secure The Dukes · ESET Dukes October 2019 · Securelist MiniDuke Feb 2013

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ad63ab0-fb5b-4bce-8bbb-bf765d324fd6

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34fb0f39-9aef-4b49-8a80-2ca457af8565

ESET Casbaneiro Oct 2019

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d97f57c-2a7c-4626-8b05-9d345047d3ad

Palo Alto PlugX June 2017

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44d29b3e-75ee-48b8-977c-5e231c49e84a

Koi Glassworm New Tricks December 2025 · Koi Glassworm Extensions November 2025 · Koi Glassworm InvisibleCode October 2025 · Aikido GlassWorm October 2025 · Socket GlassWorm January 2026 · Koi GlassWorm Rust December 2025

ATTACK:enterprise:T1102.001 → subtechnique-of → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--508dfa9b-e98a-4fb7-a34b-b74a3a7446d9

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50bd8457-3c13-483d-a647-cee4f554d490

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e165901-44c0-423e-972b-d626b0c7cebf

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6050e054-c759-4839-9ae4-5820ffcddaee

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--674031ea-4fff-4669-b44b-d289fa1cc36e

Anomali Rocke March 2019

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c51ae5d-0e55-41df-97ae-091f57c118ba

CAL_MuddyWater_Mar2026 · SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73a7af30-f2c9-4175-b7ef-1c50d7b7c738

Aikido TeamPCP Trivy MAR 2026 · Aikido CanisterWorm MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75daf0b5-2ad5-4950-a895-ec7a34de330b

Mandiant 3cx UNC4736 2023 · Unit42 3cx supply chain 2023

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d76cecb-4eec-46ea-8ca7-9844b1b0b3e6

Mandiant APT41

ATTACK:enterprise:S0069 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b0e9de1-a7b0-479e-aee7-76f2549508c6

FireEye APT17 · FireEye Periscope March 2018

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--954c6284-d1eb-48f1-96a4-1ed81b063d82

ESET RTM Feb 2017 · CheckPoint Redaman October 2019 · Unit42 Redaman January 2019

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--964a9222-6e88-4850-89cc-6fc0f10ee4c9

FireEye APT41 Aug 2019

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b9f3a63-98f1-4ea5-9c64-00bc6f237778

ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fd03410-47ca-4ddc-9202-8f4a7558b263

ESET Dukes October 2019

ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a58ad2d1-7200-4ba8-9c24-fc640306ea2f

ESET RTM Feb 2017

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab66ef8a-f496-48d2-a358-0e4f7b00d5c0

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad9a38a3-2630-437a-81ce-70c5645187cf

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3a9c32f-c6d0-46d4-8936-dd4fec61d305

Securelist Dropping Elephant

ATTACK:enterprise:S0528 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcedecdf-e98d-4cf7-84a4-d4769a10858d

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S1221 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be66b8dd-5f19-4ee5-be0e-2c871cfd6d5c

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1b5e582-0b85-430a-a7a5-310fff2b7bdf

CyberAus_Vidar_May2026 · Cyfirma_Vidar_June2024 · Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026 · Logpoint_StealerMalwareFamilies_2024 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7e1d905-6777-4299-b7d7-3465d9eac294

Flashpoint Mini Shai-Hulud MAY 2026 · Hunt.io TeamPCP Toolkit MAY 2026 · Wiz Mini Shai-Hulud MAY 2026 · Trend Micro TeamPCP MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc56f0e8-e059-403a-88e4-bd0b61bbc4b7

Unit42 Xbash Sept 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.