Malware Increasingly Uses TLS to Obfuscate Communication
Security experts working with Sophos recently published a report on the shifting trends in malware and ransomware. The publication shows that there has been a very significant surge in malware that uses TLS, or transport layer security, to obfuscate communication and avoid detection.
TLS refers to the encryption protocol that handles communication in regular HTTPS, successor to SSL, or secure sockets layer. TLS is used in a number of other applications outside of secure HTTP communication.
According to the statistics published by Sophos, malware that uses TLS for communication, whether that means receiving commands from its C2 server or downloading additional payloads, has nearly doubled. One year ago, around 24% of malware was making use of TLS encryption in its communication, while this figure has grown to nearly double that, at 46%.
The increasing adoption of TLS is due to the fact that this extra layer of obfuscation makes it that much harder for security researchers to detect and prevent the spread of malware, including ransomware.
Malware can make use of TLS in all its main modes of communication, whether this is uploading stolen data from the compromised network, communicating with its C2 server or downloading additional payloads to the victim's system.
Sophos stated that a big part of the issue with TLS being more prevalent in malware is that malware operators are using more and more legitimate web and cloud-based platforms that are inherently secured with TLS. Cloud solutions and services are commonly used for both offloading stolen data and for hosting the malicious payloads.
The security team at Sophos further states that over the past three months, more than half of all C2 servers used TLS and HTTPS to communicate with their associated malicious payloads. An example of malware using legitimate services for its purposes is a particular strain of the BitLocker ransomware that downloaded its malicious scripts from a spreadsheet hosted on Google Docs, once again using TLS encryption in the process.
This is just an illustrative example provided by Sophos. The company also published statistics on the use of malware callhome destinations. Among the big, legitimate hosting solutions, Google Cloud is in the lead with a 9% share, followed by Indian telecom provider BSNL.
