Web Service: Dead Drop Resolver

Threat Actors may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Threat Actors may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.