Malware Increasingly Hides Command-and-Control Traffic in TLS and HTTPS

Malware operators are increasingly using TLS/HTTPS to conceal command-and-control, payload delivery, and data exfiltration traffic, with one report finding TLS-backed malware rising from 23% of Internet-communicating malware in 2020 to nearly 46% in early 2021. Researchers said attackers are blending into normal encrypted traffic by abusing trusted platforms and services including Google, Discord, Pastebin, GitHub, and Telegram, while loaders, droppers, ransomware affiliates, and offensive tools such as Cobalt Strike and Metasploit increasingly rely on encrypted channels. Malware also frequently uses TLS on non-standard ports, reducing the value of simple port-based detection.

A separate analysis of 264 malware families found most SSL/TLS-protected malware communications used HTTPS, while others used SMTP and custom TCP protocols, and that many families relied on self-signed certificates or reused anomalous X.509 attributes that can expose malicious infrastructure. Researchers identified unusual subject names, abnormal serial-number lengths, invalid version fields, and suspicious validity periods as useful detection signals, while noting that some families such as IcedID, AsyncRAT, DcRAT, Vawtrak, and PhantomNet use certificate pinning to resist interception. The findings also show that attackers often deploy valid certificates from trusted authorities, especially Let’s Encrypt, underscoring that certificate metadata and anomaly-based inspection remain important for detecting encrypted malware traffic.