Payload Staging

Payload staging is a multi-stage command-and-control pattern in which a small first-stage stager calls back to a first C2 server for instructions and can obtain a more capable second-stage payload. The first stage may collect basic host information, update tools, or upload additional files; the second RAT may be configured to use a distinct C2 server with separate infrastructure. Staging can support size-constrained delivery and may obscure the later C2 channel, but this entry covers the payload-staging variant of ATT&CK T1104 Multi-Stage Channels; it does not imply every multi-stage C2 flow downloads or executes a separate RAT.