During C0017, It used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably It updated the community forum posts frequently with new dead drop resolvers during the campaign.