TACTIC: COMMAND AND CONTROL
Non-Standard Port (T1571): Real Cases
MITRE Definition ↗ Adversaries communicate using non-standard ports to bypass simple firewall rules.
Key Facts
Technique ID
T1571
Command and Control
Mapped Cases
1
Primary sources
Related Laws
1
Criminal statutes
- ATT&CK Technique Identifier: T1571.
- Tactical Phase: Command and Control.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Minh Quoc Nguyen (ChipMixer Cryptocurrency Mixer)
fugitive 2023-03-15
Operator of ChipMixer, one of the dark web's largest unlicensed cryptocurrency mixing services, charged with laundering more than $3 billion in Bitcoin associated with ransomware, North Korean state hackers, and darknet drug markets.
Primary Source Evidence Excerpt: Affidavit ¶ 14, Page 8
"ChipMixer communicated with relay nodes over non-standard high ports to evade firewall packet categorization."
U.S. District Court for the Eastern District of Pennsylvania · 2:23-mj-00122
View full case dossier →