Data Obfuscation: Protocol Impersonation

BADCALL uses a FakeTLS method during C2.^[5]

Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.^[3]

FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.^[2]

FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.^[6]

HARDRAIN uses FakeTLS to communicate with its C2 server.^[1]

KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.^[4]

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, evading SSL man-in-the-middle decryption attacks.^{[8][9][10][11]}

Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.^[7]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.