When HTTP is Not Enough: A Review of Stealthy Command and Control Protocols
Channel: FIRST
Date: 2021-02-12

At the beginning of the malware era, IRC was the main Command & Control channel used by threat actors. Then, over the last decade, HTTP(s) has become the go-to protocol for malware C&C communications for crimeware and APT groups. It led to major improvements in the monitoring of the HTTP(s) traffic. Thus, threats actors had to shift their strategy again in order to remain under the radar. In this presentation, we will explore a few cases of stealthy communication channels we encountered during our last investigations. In the first case, we will show how threat actors are able to make HTTP communications blend in by mimicking legitimate traffic. In the second case, we will use Turla, a long-lived threat actor focusing on espionage operations, as an example for mail-based C&C communications. This communication channel was abused in three different ways: by compromising the mail client or server and by interacting directly with webmail services. In the third case, we will review the usage of a very common protocol, DNS, for transmitting commands and exfiltrating data. Finally, we will propose some countermeasures to increase protection for users.
---
Matthieu Faou is a malware researcher at ESET where he specializes in targeted attacks. His main duties include threat hunting and reverse engineering of APTs. He finished his Master’s degree in computer science at École Polytechnique de Montréal and at École des Mines de Nancy in 2016. In the past, he has spoken at multiple conferences including BlueHat, REcon, Virus Bulletin, or Botconf.