Malware smugglers have settled on a new technique for evading detection encrypted messages
New research from security company Sophos reveals that threat actors are increasingly adopting encrypted communication protocols to prevent the detection of malware.
In its analysis, Sophos argues that with more legitimate adoption of HTTPS, identifying unencrypted traffic has become a lot easier for security professionals.
In order to avoid detection, more and more malware authors are adopting secure communication protocols, such as TLS, to obfuscate communication to and from command and control (C&C) servers.
We’re looking at how our readers use VPN for a forthcoming in-depth report. We’d love to hear your thoughts in the survey below. It won’t take more than 60 seconds of your time.
“We’ve seen dramatic growth over the past year in malware using TLS to conceal its communications. In 2020, 23 percent of malware we detected communicating with a remote system over the internet were using TLS; today, it is nearly 46 percent,” observes Sophos.
Encrypted communication
The security researchers also note that they’ve observed an increase in the use of TLS in ransomware attacks over the past year, particularly with manually-deployed ransomware.
More worrying, however, is that a large portion of the growth in the use of secure communications can be attributed to increased use of legitimate cloud services protected by TLS.
Sophos has observed an increase in the use of services such as Discord, Pastebin, Github and Google’s cloud services, either as repositories for malware components, or as destinations for stolen data, and even to send commands to botnets and other malware.
Also interesting is the breakdown of the destinations of the TLS malware’s traffic, in the first three months of 2021. The data reveals that nearly half of all encrypted malware communications went to servers in the United States and India.
Google’s cloud services led the field as the destination for nine percent of encrypted malware requests, with India’s state-run BSNL close behind at six percent.
In its report, Sophos suggests organizations implement an in-depth strategy to defend against the increasingly complex threats.
New research from security company Sophos reveals that threat actors are increasingly adopting encrypted communication protocols to prevent the detection of malware. In its analysis, Sophos argues that with more legitimate adoption of HTTPS, identifying unencrypted traffic has become a lot easier for security professionals. In order to avoid detection,…
