A support channel is an attacker-controlled contact path used to communicate with victims during extortion or negotiation. It may look like an email address, chat handle, web form, or portal that the attacker wants the target to use.
In cyber attacks, a support channel matters because it is part of the pressure campaign: attackers use it to offer file samples, demand payment, or push the victim to respond quickly. For defenders, the channel is not proof of a breach by itself. It should be treated as threat messaging, not evidence. Security teams should preserve the message, verify logs and data access independently, and follow incident-response procedures before engaging. Monitoring these channels can also help track attacker infrastructure and identify linked campaigns.