TACTIC: COMMAND AND CONTROL
Web Service: Dead Drop Resolver (T1102): Real Cases
MITRE Definition ↗ Adversaries post command and control addresses on external forums or paste sites.
Key Facts
Technique ID
T1102
Command and Control
Mapped Cases
1
Primary sources
Related Laws
3
Criminal statutes
- ATT&CK Technique Identifier: T1102.
- Tactical Phase: Command and Control.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Yakubets & Turashev (Evil Corp / Dridex Banking Malware)
fugitive 2019-11-14
Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.
Primary Source Evidence Excerpt: CISA Technical Analysis Report
"Dridex used public social media profile pages and paste sites as dead drop resolvers to retrieve active C2 IP addresses."
U.S. District Court for the Western District of Pennsylvania · 2:19-cr-00336
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(5)(A)
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
18 U.S.C. § 1030(a)(7)
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
18 U.S.C. § 1962(d)
RICO Conspiracy (Racketeering)
Prohibits conspiring to conduct or participate in the conduct of an enterprise's affairs through a pattern of racketeering activity.