Which propagation method uses the compromised machine to accept connections and then transfer the toolkit to new hosts using special methods?

Which propagation method uses the compromised machine to accept connections and then transfer the toolkit to new hosts using special methods?

• A. Local Subnet Scanning
• B. Hit-list Scanning
• C. Back-chaining Propagation
• D. Autonomous Propagation

Answer: (C)

This question is about how malware can use a compromised system as a pivot to spread to others. In back-chaining propagation, the infected machine becomes a relay: it accepts incoming connections from other hosts and, through those established paths, deploys or transfers the toolkit to fresh targets using specialized transfer methods. This setup lets the worm propagate even when direct scans or random connections are blocked, because the infection rides on the already-compromised host’s access channel and abilities to push the payload onward. Think of it as using the compromised host as a staging ground: it sits in the network, opens a back channel, and then carefully hands off the toolkit to new machines via methods the malware is designed to employ, exploiting the credentials or trust established on that host. Local subnet scanning would involve scanning the local network for victims directly, which doesn’t rely on an existing compromised host to accept connections. Hit-list scanning depends on precompiled target lists rather than using a pivot host to relay the toolkit. Autonomous propagation implies self-propagation without relying on a previously hacked machine to mediate the transfer. Therefore, back-chaining propagation best fits the described scenario of using the compromised machine to accept connections and then transfer the toolkit to new hosts.

This question is about how malware can use a compromised system as a pivot to spread to others. In back-chaining propagation, the infected machine becomes a relay: it accepts incoming connections from other hosts and, through those established paths, deploys or transfers the toolkit to fresh targets using specialized transfer methods. This setup lets the worm propagate even when direct scans or random connections are blocked, because the infection rides on the already-compromised host’s access channel and abilities to push the payload onward.

Think of it as using the compromised host as a staging ground: it sits in the network, opens a back channel, and then carefully hands off the toolkit to new machines via methods the malware is designed to employ, exploiting the credentials or trust established on that host.

Local subnet scanning would involve scanning the local network for victims directly, which doesn’t rely on an existing compromised host to accept connections. Hit-list scanning depends on precompiled target lists rather than using a pivot host to relay the toolkit. Autonomous propagation implies self-propagation without relying on a previously hacked machine to mediate the transfer. Therefore, back-chaining propagation best fits the described scenario of using the compromised machine to accept connections and then transfer the toolkit to new hosts.