A two-way dead-drop is a covert communication method in which malware and its operator exchange both instructions and replies through the same hidden channel. Instead of connecting to an obvious command-and-control server, the implant reads from and writes to a trusted service or object that blends into normal activity.
In cyber security, this matters because it can hide traffic inside systems defenders already trust, such as cloud documents, calendars, issue trackers, or messaging features. That makes simple domain blocking or perimeter filtering less effective. A two-way dead-drop often appears in dead-drop resolvers, where the malware uses a legitimate service as message storage, then polls it for new tasking and posts results back. Defenders look for unusual account activity, suspicious read/write patterns, abnormal API use, and identity telemetry that shows a normal collaboration object being repurposed as a command channel.