Dimitry Snezhkov - Zombie Ant Farm: Practical Tips for Playing Hide and Seek
Presents advanced C2 communication obfuscation techniques that blend malicious traffic into legitimate business protocols.
Summary
Covert C2 Channel Techniques
Dimitry Snezhkov (Senior Red Team Operator, Optiv) presents practical techniques for establishing and maintaining covert command-and-control channels that evade network detection and traffic analysis.
Protocol-Level Obfuscation
Rather than encrypting traffic (which produces anomalous TLS patterns), the talk demonstrates tunneling C2 communications inside legitimate application protocols: HTTP over standard ports with realistic User-Agent strings and cookie formats, DNS TXT record-based channels, and Microsoft Graph API-based C2 using SharePoint and OneDrive as intermediaries.
Beacon Pattern Randomization
Deterministic beacon patterns (every N seconds) are trivially detected. Snezhkov presents jitter algorithms and sleep skew techniques that randomize beacon timing to match observed human workflow patterns.
Network Sensor Evasion
The talk covers techniques to evade JA3/JA3S TLS fingerprinting, byte-frequency analysis, and deep packet inspection by configuring C2 frameworks (Cobalt Strike, Covenant) to mimic legitimate application profiles.
Related talks
Main Stage·38 min
Hila Cohen · Amit Waisel
Introduces Malproxy, an architecture for executing malicious operations through a reverse proxy that keeps malware off the victim's machine.
Main Stage·42 min
Jason Lang
Introduces advanced offensive networking techniques and covert communication channels to bypass modern enterprise perimeter monitoring and EDR telemetry.
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.