Skip to main content

Malware smugglers have settled on a new technique for evading detection

encrypted messages
(Image credit: Facebook)
Audio player loading…

New research from security company Sophos (opens in new tab) reveals that threat actors are increasingly adopting encrypted communication protocols to prevent the detection of malware (opens in new tab)

In its analysis (opens in new tab), Sophos argues that with more legitimate adoption of HTTPS (opens in new tab), identifying unencrypted traffic has become a lot easier for security professionals. 

In order to avoid detection, more and more malware authors are adopting secure communication protocols, such as TLS, to obfuscate communication to and from command and control (C&C) servers.

TechRadar needs yo...

We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.

>> Click here to start the survey in a new window (opens in new tab)<<

“We’ve seen dramatic growth over the past year in malware using TLS to conceal its communications. In 2020, 23 percent of malware we detected communicating with a remote system over the internet were using TLS; today, it is nearly 46 percent,” observes Sophos.

Encrypted communication

The security researchers also note that they’ve observed an increase in the use of TLS in ransomware attacks (opens in new tab) over the past year, particularly with manually-deployed ransomware.

More worrying, however, is that a large portion of the growth in the use of secure communications can be attributed to increased use of legitimate cloud services (opens in new tab) protected by TLS. 

Sophos has observed an increase in the use of services such as Discord (opens in new tab), Pastebin, Github and Google’s cloud services, either as repositories for malware components, or as destinations for stolen data, and even to send commands to botnets and other malware. 

Also interesting is the breakdown of the destinations of the TLS malware’s traffic, in the first three months of 2021. The data reveals that nearly half of all encrypted malware communications went to servers in the United States and India.

Google’s cloud services led the field as the destination for nine percent of encrypted malware requests, with India’s state-run BSNL close behind at six percent. 

In its report, Sophos suggests organizations implement an in-depth strategy to defend against the increasingly complex threats.

Mayank Sharma
Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.