Skip to content

Fallback Channels

Technique · ATTACK:enterprise:T1008

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1008",
  "title": "Fallback Channels",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1008",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433",
  "external_id": "T1008",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:21.689Z",
  "modified": "2026-09-09T18:39:15.900Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [

  ]
}

Explicit source assertions (59)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9063 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a04902b-be91-45d9-94de-3ccc3b7c6cbd

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d43f3a7-70ed-4d04-857e-3a9fbce86cfb

ESET Sednit Part 1

ATTACK:enterprise:S0211 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fbd4496-f715-4edd-b4da-169d6047a7c9

Symantec Linfo May 2012

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--101867a2-149c-4088-a90f-7af4b86e5013

ESET Sednit Part 2

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12daddcc-b964-485e-8c2d-10f554d78bcc

OilRig ISMAgent July 2017

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1469ff36-c655-4513-8ffa-81dcb55c4ae6

University of Birmingham C2

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1708aa35-a362-429f-be06-82dc106dfeb4

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f728f8c-8aee-4d40-9161-1cae773983d1

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0058 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--329678a6-eb6b-499b-90a8-059d1cf1a35f

Baumgartner Naikon 2015

ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36849ab3-088c-47a5-bcf9-3e68902a2e60

ESET Ebury Oct 2017

ATTACK:enterprise:S0017 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ac3a282-e1be-45f8-8974-0a94e5d43644

Mandiant APT1 Appendix · Mandiant APT1

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fa8155d-11ca-47de-902e-47e809d0ed64

Cyberreason Anchor December 2019

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--495982e4-9856-4e7f-8e05-4654d67a4d62

Unit 42 Valak July 2020

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b23ac99-3761-46f0-ad5d-2cf63a95036a

Cylance Dust Storm

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e2842c6-ce4c-4204-9f29-4442a1859f12

ESET Dukes October 2019

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ce2f48-1bb7-48f9-8ac6-56002d93672f

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S1084 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--550d2a38-7dd8-497d-b65d-43b65a3ec49e

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60636234-2547-4139-8f91-e0b984ec5d06

Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61952f05-92a3-41e0-93c4-d7486a927ece

ClearSky Siamesekitten August 2021

ATTACK:enterprise:S0051 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62c8913c-c193-4feb-ab58-88343838336d

Securelist MiniDuke Feb 2013

ATTACK:enterprise:S0059 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70a93fc8-83c0-4407-8224-ae447af1235a

Baumgartner Naikon 2015

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7327153c-c123-401b-b675-554b8070fbed

Proofpoint Bumblebee April 2022

ATTACK:enterprise:S0401 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73a5da20-5358-4da8-8417-020a7dec52cb

ANSSI Sandworm January 2021

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8492aff7-1171-4805-9052-3decdd677c94

Bitdefender Naikon April 2021

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85b5e45d-247e-4c8b-a991-95700e4d81d9

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94a1fe68-4c8f-48ca-b186-feca5f800f46

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--950399e7-c9c2-4b53-bcc8-b99d0acba8d1

Unit 42 Kazuar May 2017

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97775c58-7cb1-46e0-9504-e60a459e44d0

FireEye APT41 Aug 2019

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98fc2f95-0c93-405a-a54e-880622d8d233

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b4a4f3b-d8f4-47d2-8e63-2687c566806b

McAfee Night Dragon

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a01e5280-ae4f-4edd-bb57-e29e8426cc3b

ESET Gelsemium June 2021

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2118212-1594-4fb1-8076-5a8649756c9c

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0084 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a61cf8cf-87f1-4061-ae9d-31e8162bdfef

Cylance Dust Storm

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7005b59-48e5-4852-90f7-ed8d2c3698fa

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0034 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a713d0d3-2897-4da2-995f-df3a40f04b29

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab687dca-2741-4920-a71e-e0e0444809c5

Novetta Blockbuster RATs · Novetta Blockbuster

ATTACK:enterprise:S0610 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abdaccd2-6a3e-4bd2-8fa2-b192f67f22ca

Check Point APT34 April 2021

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af0ba134-74c9-4256-a48d-6911e98cf235

Koi Glassworm InvisibleCode October 2025 · Koi GlassWorm Rust December 2025

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2ab26e2-eb90-4f19-b35a-b8a0a5438961

ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4642810-53c4-4ff2-859f-f4b707a36097

Talos TinyTurla September 2021

ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b921077b-4a62-461c-aaec-9cd70b5cf5f8

Kaspersky Lyceum October 2021

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc21fc79-4a67-46e8-b514-efb20e92b3f7

Hunt.io TeamPCP Toolkit MAY 2026 · Wiz Mini Shai-Hulud MAY 2026 · Trend Micro TeamPCP MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd74b90d-ff9f-4ce3-96af-9b809fffc3da

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdb7f4c5-3620-479b-af38-95f42e82fb68

ESET Machete July 2019

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1d43be1-daea-4cdd-9632-e0a22f4d9073

NCC Group Team9 June 2020

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d207f54d-81c1-4b20-ba56-575fbdec2f03

ESET Crutch December 2020

ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2d98eeb-4ebd-4db5-adf8-2a737306b17f

CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3e0b0b8-797f-4638-bcb6-aa688c3a0a9a

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d96db78c-e7b8-4877-8187-07c5e801cead

Unit42 RDAT July 2020

ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc4bc74b-cd60-4853-a436-8d5e34b01564

Unit 42 QUADAGENT July 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd9f1283-ff4b-4314-b7ce-f326d6932bab

Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2317e9b-9301-4c44-959f-94d66858136c

Symantec Orangeworm April 2018

ATTACK:enterprise:S1172 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e425fe3b-b6a3-4a90-b11c-8b2fbc122f72

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:S0117 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e97b39d6-7be1-4f59-8959-7f1f01402152

ESET Sednit Part 2

ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ecca736a-9b3f-4a1d-bdb8-ff5c55197893

ESET PipeMon May 2020

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1ab6a18-2624-4d35-b9e2-3f3a4288bcac

Mythc Documentation

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5936bbd-f8cb-404a-bd43-87f7bc836294

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f96e840a-b41b-4238-a664-db6fa5bf0c22

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9fc4a7b-e8ba-4e50-b97f-9afabcfc73a8

Cyberreason Anchor December 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.