T1568: Dynamic Resolution

Command And Control Intelligence Profile

AI Answer

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, (Source: MITRE ATT&CK T1568)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1568
Name	Dynamic Resolution
Tactic	Command and Control (command-and-control)
Platforms	ESXi, Linux, macOS, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, Dynamic Resolution (T1568) is one of the highest-connectivity ATT&CK techniques: 24 MITRE STIX relationships reference this technique; 8 threat groups observed using it; 10 software families associated; 6 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1568). Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware’s communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.

Detection

Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.

Mitigation

Use intrusion detection signatures to block traffic at network boundaries.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

BRICKSTORM
Tomiris
NETEAGLE
Bisonal
RTM
SUNBURST
Maze
Gelsemium
AsyncRAT
Remcos

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

Kimsuky
RedEcho
Gamaredon Group
TA2541
BITTER
APT29
APT-C-36
Transparent Tribe

Group associations are from MITRE ATT&CK STIX relationships.

Operation Dust Storm
Indian Critical Infrastructure Intrusions
Operation Spalax
SolarWinds Compromise
Night Dragon
C0026

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1568 Dynamic Resolution. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1568 Dynamic Resolution?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace