Catch Evasive Threats That Hide Behind Real Network Traffic

View research paper: Network Detection Evasion Methods: Blending with Legitimate Traffic

Threat actors have found a way to use an enterprise’s own network traffic to cloak their activities while in the company’s system. Given this camouflage, targeted attacks are almost rendered invisible. How then can IT and security administrators catch these complex attacks when they don’t even rouse suspicion?

The most effective targeted attacks often use a combination of tried-and-tested threats, the kind that are proven effective against different network types. Attackers likely use techniques that actively exploit flaws or perform malicious routines. They then pair these up with methods that evade advanced security measures.

There is currently a lack of published information that outlines the technicalities of these advanced attack methods. However, this should not hinder IT and security administrators from keeping a close eye on the systems they’re managing. Threat actors can use the simplest methods—like taking advantage of real network traffic—to infiltrate their target networks.

There is no single way to detect or protect against threats that blend in with real network traffic. In Network Detection Evasion Methods: Blending with Legitimate Traffic, we explain how malware can be detected using a network traffic monitoring and file structure and behavior analyses. We further expound on how a combination of two or all of these security measures can be effective against threats like:

• FAKEM, a remote access Trojan (RAT) which disguises malicious traffic to look like that of Windows® Live™ Messenger or Yahoo!® Messenger
• Rodecap or Mutator, which spoofs HTML headers to blend in
• C0d0s0 or IEXPL0RE RAT, which poses as a Microsoft™ Windows update

Administrators need to ensure that they are presently ready to defend their networks against the persistence of these methods. Having the appropriate defensive strategies in place will not only help prevent these kinds of attacks from advancing within their network, it will also prepare their company for future attacks and threats that may evolve over time.