{
  "id": 7710493,
  "title": "HTTP/HTTPS Malleable C2: The Chameleon of Network Communications",
  "url": "https://urgent.news/2026/09/16/http-https-malleable-c2-the-chameleon-of-network-communications",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-16T05:13:53.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cyberrscourse/httphttps-malleable-c2-the-chameleon-of-network-communications-56ol"
  },
  "original_language": "en",
  "account": "Malleable Command and Control (C2) is a technique that disguises communication between a compromised system and a remote server, making it appear as regular web traffic. This is achieved by customizing HTTP/HTTPS requests and responses to blend in with legitimate data. The use of HTTP/HTTPS is ideal for this purpose due to the massive volume of traffic, their legitimacy, flexibility, and the added encryption of HTTPS.\n\nTraditional C2 methods used predictable patterns that could be easily detected by security tools. However, malleable C2 allows for altered patterns, such as disguising communications as Google Analytics requests or jQuery CDN requests. These disguised requests include normal-looking headers, bodies, and user agents, making them difficult to distinguish from regular traffic.\n\nThe technical structure of a malleable C2 profile includes rules for transforming HTTP GET and POST requests, headers, and bodies. For example, a beacon may randomly select URLs like /search or /news, while metadata like system information can be encoded in base64url format and sent as a cookie. The server response is also base64-encoded, appearing as HTML content.\n\nTo detect malleable C2, defenders can use various techniques, including behavioral analysis, certificate analysis, JA3/JA4 fingerprinting of TLS handshakes, network flow analysis, and endpoint detection. Despite these challenges, malleable C2 remains a powerful tool for stealthy communication in cyber attacks and security testing.",
  "summary": "Author: @cyberrscourse | Cybersecurity Education & Research Published: September 16, 2026 ⚠️ LEGAL WARNING: The techniques described in this article are for educational purposes only. Unauthorized access to computer systems is illegal under federal and international law (18 U.S.C. § 1030 - Computer Fraud and Abuse Act). Only perform security testing on systems you own or have explicit written…",
  "key_points": [
    "Malleable C2 disguises communication as regular web traffic using HTTP/HTTPS.",
    "Altered patterns mimic Google Analytics or jQuery CDN requests to blend in.",
    "Detection techniques include behavioral analysis, JA3/JA4 fingerprinting, and network flow analysis."
  ],
  "editors_take": "The emergence of malleable C2 techniques significantly raises the bar for security defenders, enabling attackers to blend their communications with legitimate web traffic and evade traditional detection methods.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}