Data Obfuscation: Protocol or Service Impersonation

BADCALL uses a FakeTLS method during C2.^[3]

Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.^[4]

BOOKWORM has modified HTTP POST requests to resemble legitimate communications.^[5]

During C0017, APT41 frequently configured the URL endpoints of their stealthy passive backdoor LOWKEY.PASSIVE to masquerade as normal web application traffic on an infected server.^[6]

Cobalt Strike can leverage the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.^[7]

FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.^[8]

FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.^[9]

FRAMESTING uses a cookie named DSID to mimic the name of a cookie used by Ivanti Connect Secure appliances for maintaining VPN sessions.^[10]

HARDRAIN uses FakeTLS to communicate with its C2 server.^[11]

Higaisa used a FakeTLS session for C2 communications.^[12]

InvisiMole can mimic HTTP protocol with custom HTTP "verbs" HIDE, ZVVP, and NOP.^[13][14]

KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.^[15]

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.^{[16][17][18][19]}

Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers.^[20]

Ninja has the ability to mimic legitimate services with customized HTTP URL paths and headers to hide malicious traffic.^[21]

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.^[1]

PUBLOAD has modified HTTP POST requests to resemble legitimate communications.^[22][5] PUBLOAD used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. PUBLOAD has utilized FakeTLS headers with the bytes 17 03 03.^[23]

StarProxy has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. StarProxy used FakeTLS to communicate with its C2 server.^[20]

SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.^[24]

TAINTEDSCRIBE has used FakeTLS for session authentication.^[25]

TONESHELL used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic.^[23][20] TONESHELL variants have utilized FakeTLS headers with the bytes 0x17 0x03 0x03 to represent TLSv1.2 and 0x17 0x03 0x04 for TLSv1.3.^[20]

Uroburos can use custom communication methodologies that ride over common protocols including TCP, UDP, HTTP, SMTP, and DNS in order to blend with normal network traffic. ^[26]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.