Skip to content

Bidirectional Communication

Subtechnique · ATTACK:enterprise:T1102.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1102.002",
  "title": "Bidirectional Communication",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1102/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--be055942-6e63-49d7-9fa1-9cb7d8a8f3f4",
  "external_id": "T1102.002",
  "domain": "enterprise",
  "created": "2020-03-14T22:34:03.024Z",
  "modified": "2026-09-03T19:46:40.085Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    }
  ]
}

Explicit source assertions (59)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0393 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--033a5e59-ab65-485b-a9c0-775977e8abd0

ESET Turla PowerShell May 2019

ATTACK:enterprise:S0651 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--092ae5be-2a12-46ff-8122-2e308d954401

Checkpoint IndigoZebra July 2021

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d57e872-1062-4bab-b3c5-3cea17cba4dc

ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d7e0555-3176-4ebe-b067-6e557e9040a9

ESET Dukes October 2019

ATTACK:enterprise:S1222 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f1582a7-f9d3-4397-bab7-57fbb9a16ebd

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f3a304a-574d-4ccc-b7d6-c546cd27fedd

ESET Crutch December 2020

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17d85f51-c89f-440c-be28-5f74d9264723

Trend Micro DRBControl February 2020 · Talent-Jump Clambling February 2020

ATTACK:enterprise:S0229 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a04e8c4-f697-446b-810a-8162ad7353ef

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S0025 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2244e21e-b7f6-476f-8f58-67db772f9736

Mandiant APT1 Appendix · Mandiant APT1

ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--233d1a32-f826-4705-a535-806edee8a5aa

F-Secure CozyDuke

ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--234dc427-cce0-45d5-9971-02890aff608d

ASERT Donot March 2018

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--270a7179-63db-479d-95e5-84dccbe1aa3a

Talos Kimsuky Nov 2021 · Securonix Kimsuky February 2025 · Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:S0218 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b789109-44c7-4195-8df8-50b1e09b1a69

FireEye APT37 Feb 2018

ATTACK:enterprise:S1170 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c713523-db2e-4ef6-9a2e-3913bc31051d

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30e68a86-bbfc-4677-9815-b256be560f09

IBM Grandoreiro April 2020 · ESET Grandoreiro April 2020

ATTACK:enterprise:G1005 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--322fcce0-fe46-48f2-b57c-01b73b316339

Microsoft POLONIUM June 2022

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32bb5463-c8b5-4ba1-bc13-b242548d5aba

FireEye APT37 Feb 2018 · Talos Group123

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3674346a-5212-4b42-9c1d-3e73eee95d06

Palo Alto Comnie

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f37a188-b994-4191-aee1-56d0c60101e1

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S1168 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--441bd844-93d8-4b57-b353-de1ea85a26d0

ESET OilRig Downloaders DEC 2023 · ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S0333 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45952aea-8bd7-4f6d-8b23-ee2914860454

PaloAlto UBoatRAT Nov 2017

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53a66a44-0620-4edc-bb9d-c40cfcb17546

Lazarus APT January 2022

ATTACK:enterprise:G0005 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a49400c-2003-463c-8e6e-97b79f560675

Meyers Numbered Panda

ATTACK:enterprise:S1023 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a73d370-7d3d-45ff-b096-acd5bcacad08

Microsoft POLONIUM June 2022

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b875be8-3849-46e2-80cb-dec502f78f52

BitDefender Chafer May 2020

ATTACK:enterprise:S0054 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ebd97d4-1979-40b2-b38b-b6ed44a2f32f

F-Secure The Dukes

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f8c46e4-c0d1-4c39-8a31-3d631f3946df

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ff34c78-2c85-4be5-b3db-0ec8543087d9

ESET ComRAT May 2020 · CISA ComRAT Oct 2020

ATTACK:enterprise:S1172 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71c7cb53-415c-4ce5-9914-40227071b175

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79c960d7-edf2-4005-8c0a-31acd830ca8a

Cofense RevengeRAT Feb 2019

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79f89b33-046c-4bfa-a12d-c50fa0d84ea6

Unit 42 Magic Hound Feb 2017

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fcd4b9b-87e3-4e8c-abde-84639c85467f

ESET Turla Mosquito Jan 2018 · ESET Turla Mosquito May 2018

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82c32444-f9a1-4370-b72c-2db8c91e9ac3

Microsoft POLONIUM June 2022

ATTACK:enterprise:S0270 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83bab2a0-5cbc-406e-beaf-a657ef73717d

Unit42 DarkHydrus Jan 2019

ATTACK:enterprise:S0042 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c9f23e6-2665-45b3-9c28-53a9335b16ce

FireEye admin@338

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d4a82db-fce4-4dcc-a0d3-8aa14cbf2ee3

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9420f3cb-bd87-4dae-b8a7-0f1a5a14da55

Unit 42 Kazuar May 2017

ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a732c265-07f0-4e9b-a42c-0df6277e5b27

Forcepoint Carbanak Google C2

ATTACK:enterprise:S0511 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7e27068-7c65-45a0-968e-4871720f3348

ESET Dukes October 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac4e0574-879e-4155-84ed-5b2d8be0b603

Github PowerShell Empire

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ada291f4-524c-4400-9425-0936a03d4a41

FireEye FIN7 Aug 2018

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b45c7b78-55c7-4418-ab03-9f805de7376d

Talos ROKRAT · Securelist ScarCruft May 2019 · Volexity InkySquid RokRAT August 2021

ATTACK:enterprise:S1171 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8c4347b-0181-40f8-a6f4-3d1c1bc7081e

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:S0026 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb8149a2-fdda-4c3a-9e02-f530c4ee7962

CyberESI GTALK · Mandiant APT1

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb8dc4b5-4308-4c84-a63a-ab3d5fa9053e

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:T1102.002 → subtechnique-of → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbddae2e-69d5-4b4f-a091-42d12075e007

ATTACK:enterprise:S0215 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2178e88-74c3-4bc6-b8c5-f6bbc95fc65a

FireEye APT37 Feb 2018

ATTACK:enterprise:S0213 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2fcdaf4-f4e7-446d-8b92-7a9df7ccc1f8

FireEye APT37 Feb 2018 · Unit 42 Nokki Oct 2018

ATTACK:enterprise:S0216 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d122e56a-b0d7-4eb2-bcee-def5d4cbf5bd

FireEye APT37 Feb 2018

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d66da21d-1a8c-4b32-b700-f1d3d938b57e

ESET Telebots Dec 2016 · ESET Telebots June 2017

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8a1fe73-2234-4d74-a09c-a84b9cf3e7d1

Splunk LAMEHUG SEP 2025 · Nov AI Threat Tracker

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da759124-8047-4b58-b7d4-fa9300cb4ce1

TrendMicro Pawn Storm Dec 2020

ATTACK:enterprise:S1035 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd7f2e12-d646-4a89-9ba6-4f20e88fb7db

NCSC GCHQ Small Sieve Jan 2022

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e74a286e-81d0-42f1-85c5-954631525871

Cisco LotusBlossom 2025

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8ea86ae-0cdc-4521-a9da-357e53514115

Anomali Static Kitten February 2021

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f309c2e1-779f-4ff4-b6b7-579aca478239

Google Election Threats October 2020 · Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f62632c0-cddf-40ba-bba0-647b5c523606

ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S0069 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd6055a0-7db2-4135-a87f-156354c97f0b

FireEye APT17 · FireEye Periscope March 2018

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff5db468-c3a7-4292-9a50-237cf163cb37

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.