Everything Is a C2 If You're Brave: Unconventional Egress Channels
Mauro Eldritch and Luis Ramirez automate unconventional C2 channels, routing command-and-control traffic through messaging apps, social media, and video game servers.
Summary
The Limitations of Traditional Web C2 Channels
Enterprise security perimeter appliances strictly inspect standard HTTP/HTTPS and DNS traffic, flagging abnormal beaconing intervals and newly registered domains.
Weaponizing Legitimate Platforms for Stealthy Egress
Mauro Eldritch and Luis Ramirez demonstrate repurposing trusted third-party cloud platforms as covert Command & Control (C2) message brokers.
Automating Wacky and Unexpected C2 Transports
The authors build working proofs-of-concept routing C2 beacons through messaging apps (Telegram, Discord), social media profiles, and multiplayer video game chat protocols.
Detection Strategies for Unconventional Traffic
The presentation provides blue teams with behavioral heuristics and network anomaly detection methods to spot data exfiltration over legitimate SaaS and gaming platforms.
Related talks
NorthSec·46 min
Etienne Martineau
Security researchers examine technical aspects of Etienne Martineau - Inter VM Data Exfiltration: The Art of Cache Timing Covert Channel ....
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.
Main Stage·47 min
Dimitry Snezhkov
Presents advanced C2 communication obfuscation techniques that blend malicious traffic into legitimate business protocols.