HTTP/HTTPS Malleable C2: The Chameleon of Network Communications

Malleable Command and Control (C2) is a technique that disguises communication between a compromised system and a remote server, making it appear as regular web traffic. This is achieved by customizing HTTP/HTTPS requests and responses to blend in with legitimate data. The use of HTTP/HTTPS is ideal for this purpose due to the massive volume of traffic, their legitimacy, flexibility, and the added encryption of HTTPS.

Traditional C2 methods used predictable patterns that could be easily detected by security tools. However, malleable C2 allows for altered patterns, such as disguising communications as Google Analytics requests or jQuery CDN requests. These disguised requests include normal-looking headers, bodies, and user agents, making them difficult to distinguish from regular traffic.

The technical structure of a malleable C2 profile includes rules for transforming HTTP GET and POST requests, headers, and bodies. For example, a beacon may randomly select URLs like /search or /news, while metadata like system information can be encoded in base64url format and sent as a cookie. The server response is also base64-encoded, appearing as HTML content.

To detect malleable C2, defenders can use various techniques, including behavioral analysis, certificate analysis, JA3/JA4 fingerprinting of TLS handshakes, network flow analysis, and endpoint detection. Despite these challenges, malleable C2 remains a powerful tool for stealthy communication in cyber attacks and security testing.