New Report Reveals 1M+ Malware Samples Exploiting Application Layer for Stealthy C2

A recent cybersecurity analysis of over one million malware samples has revealed that adversaries are increasingly leveraging Application Layer Protocols to conduct stealthy Command-and-Control (C2) operations.

The findings, detailed in the Red Report 2025, highlight the growing sophistication of attackers who exploit these protocols to blend malicious activities with legitimate network traffic, evading detection by traditional security measures.

The study underscores the abuse of MITRE ATT&CK Technique T1071, which involves the use of widely trusted protocols such as HTTP/S, DNS, SMTP, and MQTT.

These protocols, integral to everyday network communication, are manipulated by attackers to issue commands, exfiltrate data, and maintain persistent access across compromised systems.

Sophisticated Techniques Obscure Malicious Traffic

The research reveals that adversaries often select protocols based on their ubiquity and perceived innocuousness in specific environments.

For instance:

• Web Protocols (T1071.001): HTTP and HTTPS are favored for their widespread use in web browsing.
• DNS (T1071.004): Attackers embed encoded commands within DNS queries to bypass traditional security measures.
• File Transfer Protocols (T1071.002): Protocols such as SMB and FTP are used to transfer payloads while mimicking legitimate file-sharing activities.
• Mail Protocols (T1071.003): SMTP and IMAP are exploited to exfiltrate sensitive data via email attachments or drafts. .
• Publish/Subscribe Protocols (T1071.005): Emerging threats like IOCONTROL malware utilize MQTT for encrypted C2 communication, blending with IoT traffic to evade detection.

Implications for Cyber Defense

Picus Security report highlights the inherent challenges in detecting malicious activity within trusted communication channels.

By embedding commands within routine traffic or encrypting communications, attackers render traditional monitoring tools less effective.

For example, malware campaigns increasingly rely on HTTPS encryption and DNS tunneling to evade packet inspection techniques.

Security experts emphasize the need for advanced threat detection solutions capable of analyzing behavioral patterns rather than relying solely on signature-based methods.

Proactive measures such as deep-packet inspection, anomaly detection, and zero-trust architectures are critical in mitigating these threats.

The findings also stress the importance of cross-industry collaboration and intelligence sharing to counteract evolving adversarial tactics.

As attackers continue to refine their methods, organizations must adopt a multi-layered defense strategy that includes endpoint protection, network segmentation, and continuous monitoring of application-layer traffic.

This report serves as a stark reminder of the evolving threat landscape and the critical need for robust cybersecurity frameworks to address the exploitation of trusted protocols for malicious purposes.

Also Read:

SHA256 Hash Computation from Data Chunks

See more