MQTT C2 Communication via Non-IoT Processes on Port 1883/8883

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.