Log in Request a demo

Attack technique

Dead Drop Resolver: Hiding C2 Addresses on Public Web Services (T1102.001)

Also known as Dead Drop Resolver, Web Service: Dead Drop Resolver

A dead drop resolver is a page on a legitimate web service that holds the address of the attacker's real command and control server.

In short

A dead drop resolver is a page on a legitimate web service that holds the address of the attacker's real command and control server. Malware reads the page, learns where to connect and can be pointed elsewhere by changing the page. MITRE tracks this as T1102.001.

Last updated 26 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Command and Control · Step 13 Of 15 In The Attack Chain

  1. MITRE IDT1102.001ATT&CK technique
  2. Detection4ways to spot itThe same fetch on a schedule
  3. Defences4ways to stop itUse network signatures

How it works

MITRE says adversaries may use an existing, legitimate external web service to host information that points to additional command and control infrastructure. The posted content, the dead drop resolver, often carries an embedded and often obfuscated or encoded domain or IP address. Once infected, victims reach out to the resolver and are redirected by it.

MITRE adds that popular websites and social media give a lot of cover, because hosts in a network already talk to them before any compromise. MITRE also says web services commonly use TLS. A dead drop resolver also keeps the back-end infrastructure out of reach of malware binary analysis and means that infrastructure may be dynamically changed.

A real example

MITRE lists many users of the technique, among them the 3CX Supply Chain Attack campaign, Kimsuky, APT41, PlugX, MiniDuke and GlassWorm. On 21 October 2026 the malicious LiteLLM 1.107.0 release carried a hidden loader. Once an hour it read a hostname from a file in a GitHub repository and fetched code from that host.

StepSecurity says the GitHub account was deleted afterwards but infected hosts keep polling it. See the LiteLLM 1.107.0 incident profile and our dead drop explainer.

How to detect

  1. Python or scripts reading a raw file on a code host

    MITRE's detection strategy DET0058 looks for a process or script that accesses a common web service to retrieve content that may hide a secondary C2 address.

  2. The same fetch on a schedule

    A request to the same file again and again at a fixed interval, from a process that is not a browser or a build tool, is a lead. StepSecurity says the LiteLLM loader polled its GitHub file every hour.

  3. A request to a bare host and a short path

    StepSecurity says the LiteLLM loader downloaded code from the hostname it read, at the path /codepy. Any such request means remote code ran, so treat it as a confirmed hit.

  4. Egress logs for the named account

    For a known case, search proxy and DNS logs for the dead drop address. StepSecurity advises alerting on raw.githubusercontent.com/letters9813/ and on /codepy.

How to defend

  1. Restrict web content that is not needed

    MITRE lists M1021, Restrict Web-Based Content: use web proxies to enforce your external communication policy and block unauthorized services.

  2. Use network signatures

    MITRE lists M1031, Network Intrusion Prevention: signature-based systems can block the traffic of specific malware.

  3. Block the known resolver and the C2 domain

    For LiteLLM, StepSecurity advises blocking litellm.dev at DNS or egress, because a deleted account does not stop infected hosts from polling.

  4. Remove the loader, not only the package

    StepSecurity's steps are to stop the process holding the loader lock file, delete the startup files and rebuild the environment from scratch.

Questions

What is a dead drop resolver?

MITRE describes it as content posted on a legitimate web service that points infected hosts to additional command and control infrastructure. It often carries an embedded and obfuscated domain or IP address.

Why do attackers use a public web service?

MITRE says hosts already talk to popular sites before a compromise, so the traffic hides in expected noise, and TLS adds protection. It also says the back-end infrastructure may be dynamically changed.

Is a deleted dead drop harmless?

Not necessarily. StepSecurity says the account behind the LiteLLM dead drop was deleted, yet infected hosts keep polling it. It warns that re-registering the username would allow code execution on hosts that are still infected.

In our research

  1. LiteLLM’s Dead Drop Explained: Infected Hosts Still Poll a Deleted Account October 2026
  2. LiteLLM 1.107.0 Supply Chain Attack: Timeline, Stolen Data and a Response Checklist October 2026
  3. APT41 Threat group

Sources

  1. Web Service: Dead Drop Resolver, T1102.001 MITRE ATT&CK
  2. Web Service, T1102 MITRE ATT&CK
  3. litellm 1.107.0 Compromised on PyPI and Docker: Credential Stealer and Hourly Remote Code Loader StepSecurity

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT41

MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. The US Department of Justice charged five Chinese nationals in 2019 and 2020 and said the hacking reached more than 100 victims.

Read more

Glossary term

Command and control (C2)

Command and control (C2) is how an attacker communicates with systems they have compromised in order to control them.

Read more