Keypoints
- Junk data is added to C2 traffic to break naive decoding and signature matching.
- Obfuscation can be prepended, appended, or interleaved within legitimate protocol fields.
- Detection requires content-aware inspection and statistical analysis of payloads.
- Monitor for clients sending disproportionately more data than they receive.
- Combine endpoint process visibility with network content logs for accurate detection.
Description:
- Like adding static to a radio broadcast so the real message is hard to hear, junk data hides malicious commands in noise to confuse casual inspection.
- Adversaries embed random or meaningless characters into protocol streams used for command and control; this prevents trivial decoding and analysis, enabling covert communication and making traffic appear benign to simple filters.
Detection:
- Use deep packet inspection (DPI) to validate protocol conformance on expected ports and flag malformed fields.
- Perform payload entropy and statistical analysis to find unusually high randomness or repeating junk patterns.
- Monitor flow metrics for asymmetric transfers where a client sends far more data than it receives.
- Correlate network flows with endpoint process telemetry to spot unexpected network-using processes.
- Deploy IDS/IPS rules tuned to detect common junk insertion techniques and update them with threat intel indicators.
- Inspect TLS-encrypted channels with enterprise TLS inspection or endpoint TLS decryption to analyze payload contents when legally permitted.
- Watch for rare or never-before-seen protocols on hosts and investigate any deviations from baseline application behavior.
Tactics:
Command and Control
Platforms:
ESXi, Linux, Windows, macOS
Data Sources:
Network Traffic: Network Traffic Content
Relationship Citations:
(Citation: Volexity UPSTYLE 2024),(Citation: MSTIC NOBELIUM Mar 2021),(Citation: Kaspersky Lyceum October 2021),(Citation: ESET PLEAD Malware July 2018),(Citation: Group IB GrimAgent July 2021),(Citation: Dell P2P ZeuS),(Citation: CISA WellMess July 2020),(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023),(Citation: ESET Sednit Part 3),(Citation: FireEye SUNBURST Backdoor December 2020),(Citation: CrowdStrike StellarParticle January 2022),(Citation: Securelist APT10 March 2021),(Citation: ESET BackdoorDiplomacy Jun 2021),(Citation: DHS CISA AA22-055A MuddyWater February 2022),(Citation: FireEye APT28),(Citation: TrendMicro BlackTech June 2017),(Citation: Unit42 BendyBear Feb 2021),