Tradecraft

What is Dead drop?

A hidden place to leave something for another person to collect later without meeting. In malware, a public page hiding C2 details.

In traditional espionage, a dead drop is a hidden location where an agent leaves material for a handler to collect later, so the two never meet. In malware, a dead drop resolver is a legitimate public service, such as a social media profile, paste site or code repository, where the operator posts encoded information that the malware reads to find its real C2 server.

Using a trusted public site means the malware's first connection looks harmless, and the operator can change the C2 address by editing a post.

Where you learn it

See Dead drop in a real investigation

Our missions put you in front of real logs, domains and forums, with these terms underlined where they appear.

Start learning free