A JSON-bin relay is a command-and-control pattern that uses a legitimate service to store small JSON documents containing tasking or results. The implant polls the bin over ordinary HTTPS, which makes the traffic look like normal web activity rather than attacker-owned infrastructure.
What Makes a JSON-Bin Relay Distinct
A JSON-bin relay is a command-and-control pattern that hides tasking inside small JSON objects stored in a legitimate web service. The implant polls that service over ordinary HTTPS, so the exchange blends into normal outbound traffic and inherits the service’s availability and trust.
The key distinction is that the relay is not the payload itself, but the communications layer around it. Operators use a public or shared JSON store as a lightweight mailbox, which makes the channel easy to stand up, simple to update, and harder to distinguish from ordinary application traffic than a custom server.
How the Relay Works in Practice
At a functional level, the implant repeatedly retrieves JSON records, interprets fields such as commands, URLs, or task IDs, and then writes back results in the same format. That bidirectional pattern lets the operator issue new instructions without maintaining a dedicated high-friction infrastructure footprint.
Because the channel rides over HTTPS and uses a legitimate service, defenders may see only routine web access unless they inspect destination reputation, request cadence, payload structure, and the relationship between the requesting host and the chosen service. The technique depends more on operational blending than on protocol novelty.
JSON is especially convenient here because it is compact, structured, and common in web workflows. That makes the traffic easier to embed in normal looking API-like exchanges, but it also means the malicious intent is often carried by context, timing, and repeated polling behavior rather than by obviously suspicious syntax.
Why Attackers Use JSON-Bin Relays
Attackers favor this pattern when they want resilience, low setup cost, and a channel that is less likely to be blocked than direct beaconing to attacker-owned infrastructure. A relay hosted on a legitimate service can also complicate takedown efforts, since defenders must distinguish the abuse from legitimate tenant or customer use.
The approach is useful when command content is small, when the implant runs in environments with egress filtering that still allows common HTTPS, and when the operator values flexibility over speed. It is often one piece of a larger tradecraft chain, not a standalone objective.
Detection usually depends on correlations, for example uncommon polling intervals, unusual user agents, weakly justified use of a JSON storage service, or a process that repeatedly contacts a service that has no business function for that host.
Operational Implications for Detection and Response
For defenders, the most important implication is that normal web encryption does not make the channel benign. A JSON-bin relay can move command data, tasking, and results through an apparently ordinary service, so response teams need visibility into destinations, request patterns, and process-to-network attribution rather than relying on domain reputation alone.
When this pattern is suspected, the practical question is whether the service is being used as infrastructure for remote control, not whether the traffic looks like a browser session. MITRE ATT&CK Enterprise Matrix is useful for mapping the activity to beaconing, command-and-control, and credential or lateral-movement follow-on techniques.
Teams should also treat the relay as a trust-boundary issue. NIST Cybersecurity Framework 2.0 helps frame the problem across identify, protect, detect, respond, and recover, especially where legitimate external services become part of an adversary communications path.
How JSON-Bin Relays Compare with Other C2 Channels
Compared with direct IP-based command-and-control, a JSON-bin relay is less dependent on owned infrastructure and can be easier to rotate. Compared with domain fronting or bespoke tunnels, it is often simpler to implement because the carrier is an ordinary web service rather than a specialized evasion layer.
That simplicity is part of the appeal. The operator gets a low-friction store-and-poll workflow, while defenders face a channel that looks like routine application integration unless they know the expected business use of the destination service.
From a control perspective, the technique sits in the intersection of web traffic, cloud service abuse, and remote administration tradecraft. OWASP API Security Top 10 is relevant when the relay resembles an abused API workflow, especially where authentication, object access, or request validation are weak. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful for anchoring logging, access control, and configuration controls that reduce the chance of abuse or improve visibility.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1105 — Ingress Tool Transfer | JSON-bin relays support remote tasking and data transfer over a web service |
| T1071.001 — Web Protocols | The relay hides command traffic inside ordinary HTTPS/web requests | |
| Recommendation — Correlate suspicious polling and payload exchange to T1105 and inspect the remote-control path. Track HTTPS-based tasking as T1071.001 and verify whether the destination service is legitimate. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | Detection of relay polling depends on monitoring outbound service use and unusual network patterns |
| PR.AA-05 — Identity and access permissions are managed, incorporating the principles of least privilege and separation of duties | Abuse often benefits from overly broad access to external services or internal tooling | |
| Recommendation — Monitor outbound web service access for unusual cadence, destinations, and payload patterns. Apply least privilege to service access and restrict which processes may reach external JSON stores. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Reviewing request logs and process attribution is central to spotting relay behavior |
| AC-4 — Information Flow Enforcement | The pattern depends on outbound flows to a legitimate external service | |
| SC-7 — Boundary Protection | Boundary controls matter when adversaries use common HTTPS to exfiltrate tasking and results | |
| Recommendation — Review audit data for repeated service polling, unusual endpoints, and suspicious write-back activity. Enforce information flow restrictions for processes that do not need access to external JSON storage services. Inspect and control egress paths so web traffic to external services is visible and policy enforced. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Abuse is easier when legitimate services expose weakly governed write/read behavior |
| API2 — Broken Authentication | Unauthorized use of a service for relay traffic often depends on weak or missing request authentication | |
| Recommendation — Harden service settings and access controls so external JSON endpoints cannot be repurposed for covert tasking. Require strong authentication and verify that only intended clients can write or read relay-like data. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Log review is a primary way to detect abusive polling and data exchange |
| Recommendation — Centralize and review logs for repeated HTTPS polling, unusual user agents, and unexpected writes. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org