[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1102":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1102","T1102","Web Service",28,"MITRE","**What attackers do.** Attackers use legitimate external web services, such as cloud storage, code hosting, social media or messaging platforms, to relay commands and data to compromised systems. Because traffic goes to trusted, widely used sites, it is hard to block. This serves Command and Control.\n\n**How to defend.** Decide which web services the business actually needs and restrict the rest at the proxy, especially from servers. Use tenant restrictions where available so staff can only reach corporate instances of cloud services. Log proxy traffic with process attribution so you can see which program is talking to each service.\n\n**Signs to look for.** Look for unusual processes connecting to cloud storage, paste sites or messaging APIs, regular polling to the same service, and access to personal rather than corporate tenants. The main gap is allowlisting popular domains entirely, which gives attackers a trusted channel.","Adversaries may use an existing, legitimate external Web service as a means for relaying data to\u002Ffrom a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL\u002FTLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1102\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ai-assisted-bank-breaches-and-poem-guided-malware-highlight-evolving-c2-evasion-tactics","AI-Assisted Bank Breaches and Poem-Guided Malware Highlight Evolving C2 Evasion Tactics","2026-10-09T14:21:32.64+00:00",{"slug":25,"title":26,"published_at":27},"poellm-botnet-hides-c2-infrastructure-in-github-poem-to-evade-detection","PoeLLM Botnet Hides C2 Infrastructure in GitHub Poem to Evade Detection","2026-10-07T16:20:39.103+00:00",{"slug":29,"title":30,"published_at":31},"antino-backdoor-abuses-microsoft-365-for-stealthy-c2-in-asia-espionage-campaign","Antino Backdoor Abuses Microsoft 365 for Stealthy C2 in Asia Espionage Campaign","2026-10-02T18:20:59.758+00:00",{"slug":33,"title":34,"published_at":35},"ai-powered-carbonato-botnet-hijacks-exposed-docker-hosts","AI-Powered Carbonato Botnet Hijacks Exposed Docker Hosts","2026-09-24T22:21:47.499+00:00",{"slug":37,"title":38,"published_at":39},"macsync-malware-hijacks-icloud-calendars-to-deliver-payloads","MacSync Malware Hijacks iCloud Calendars to Deliver Payloads","2026-09-24T22:20:58.618+00:00",{"slug":41,"title":42,"published_at":43},"moviereaper-malware-spreads-via-torrent-files-using-blockchain-obscured-c2","MovieReaper Malware Spreads via Torrent Files Using Blockchain-Obscured C2","2026-09-22T16:20:24.995+00:00",{"slug":45,"title":46,"published_at":47},"chainscript-rat-uses-blockchain-to-evade-c2-detection","ChainScript RAT Uses Blockchain to Evade C2 Detection","2026-09-21T10:20:42.335+00:00",{"slug":49,"title":50,"published_at":51},"moviereaper-trojan-spreads-via-compromised-torrents-using-blockchain-c2","MovieReaper Trojan Spreads via Compromised Torrents Using Blockchain C2","2026-09-17T14:20:53.271+00:00",{"slug":53,"title":54,"published_at":55},"clickfix-campaigns-use-trusted-cloud-services-to-trick-users-and-evade-detection","ClickFix Campaigns Use Trusted Cloud Services to Trick Users and Evade Detection","2026-09-08T18:20:39.611+00:00",{"slug":57,"title":58,"published_at":59},"toy-ghouls-deploy-mqtt-and-matrix-based-backdoors-against-russian-orgs","Toy Ghouls Deploy MQTT and Matrix-Based Backdoors Against Russian Orgs","2026-09-04T12:21:34.318+00:00",{"slug":61,"title":62,"published_at":63},"clickfix-abuses-polygon-blockchain-to-hide-c2-infrastructure-across-31-orgs","ClickFix Abuses Polygon Blockchain to Hide C2 Infrastructure Across 31 Orgs","2026-09-01T16:21:50.475+00:00",{"slug":65,"title":66,"published_at":67},"ftp-banner-abuse-used-to-deliver-stealthy-remote-access-trojans","FTP Banner Abuse Used to Deliver Stealthy Remote Access Trojans","2026-08-21T12:20:43.345+00:00",[69,74,79,84,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",21,{"slug":75,"name":76,"problem":77,"stories":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",11,{"slug":80,"name":81,"problem":82,"stories":83},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",8,{"slug":85,"name":86,"problem":87,"stories":83},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":89,"name":90,"problem":91,"stories":92},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",7,{"slug":94,"name":95,"problem":96,"stories":97},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",6,[99,105,110,115,120,125,130,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","13","Control 13","Network Monitoring and Defense",23,{"family":106,"item":107,"code":108,"title":109,"together":73},"nist-800-53","sc-7","SC-7","Boundary Protection",{"family":100,"item":111,"code":112,"title":113,"together":114},"9","Control 9","Email and Web Browser Protections",16,{"family":106,"item":116,"code":117,"title":118,"together":119},"si-3","SI-3","Malicious Code Protection",15,{"family":106,"item":121,"code":122,"title":123,"together":124},"si-4","SI-4","System Monitoring",14,{"family":126,"item":127,"code":128,"title":129,"together":124},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":131,"item":132,"code":133,"title":134,"together":135},"gdpr","32","Article 32","Security of processing",10,{"family":106,"item":137,"code":138,"title":139,"together":140},"at-2","AT-2","Literacy Training and Awareness",9]