New research from security company Sophos (opens in new tab) reveals that threat actors are increasingly adopting encrypted communication protocols to prevent the detection of malware (opens in new tab).
In order to avoid detection, more and more malware authors are adopting secure communication protocols, such as TLS, to obfuscate communication to and from command and control (C&C) servers.
We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.
>> Click here to start the survey in a new window (opens in new tab)<<
- Protect your devices with these best antivirus software (opens in new tab)
- Here are the best firewall (opens in new tab) apps and services
- Here’s our collection of the best disaster recovery services (opens in new tab)
“We’ve seen dramatic growth over the past year in malware using TLS to conceal its communications. In 2020, 23 percent of malware we detected communicating with a remote system over the internet were using TLS; today, it is nearly 46 percent,” observes Sophos.
The security researchers also note that they’ve observed an increase in the use of TLS in ransomware attacks (opens in new tab) over the past year, particularly with manually-deployed ransomware.
More worrying, however, is that a large portion of the growth in the use of secure communications can be attributed to increased use of legitimate cloud services (opens in new tab) protected by TLS.
Sophos has observed an increase in the use of services such as Discord (opens in new tab), Pastebin, Github and Google’s cloud services, either as repositories for malware components, or as destinations for stolen data, and even to send commands to botnets and other malware.
Also interesting is the breakdown of the destinations of the TLS malware’s traffic, in the first three months of 2021. The data reveals that nearly half of all encrypted malware communications went to servers in the United States and India.
Google’s cloud services led the field as the destination for nine percent of encrypted malware requests, with India’s state-run BSNL close behind at six percent.
In its report, Sophos suggests organizations implement an in-depth strategy to defend against the increasingly complex threats.
- These are the best endpoint protection tools (opens in new tab)