Data Obfuscation: Junk Data

APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.^[2]

BeaverTail has added junk data or a dummy character prepended to a string to hamper decoding attempts.^[3]

BendyBear has used byte randomization to obscure its behavior.^[4]

Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.^[5]

GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.^[6]

GrimAgent can pad C2 messages with random generated values.^[7]

Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.^[8]

LODEINFO can append C2 communication with randomly generated junk data.^[9][10]

Mori has obfuscated the FML.dll with 200MB of junk data.^[11]

P2P ZeuS added junk data to outgoing UDP packets to peer implants.^[12]

P8RAT can send randomly-generated data as part of its C2 communication.^[13]

PLEAD samples were found to be highly obfuscated with junk code.^[14][15]

SUNBURST added junk bytes to its C2 over HTTP.^[1]

TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.^[16]

Turian can insert pseudo-random characters into its network encryption setup.^[17]

UPSTYLE retrieves a non-existent webpage from the command and control server then parses commands from the resulting error logs to decode commands to the web shell.^[18]

Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.^[19]

WellMess can use junk data in the Base64 string for additional obfuscation.^[20]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.

Processes generating large outbound connections with disproportionate send/receive ratios, often to uncommon ports or hosts, potentially inserting meaningless data into protocol payloads.

Outbound traffic with anomalous payload sizes and patterns from non-networking processes, often observed via packet inspection or connection logs.

Previously unseen applications generating outbound connections with atypical data flow characteristics, such as excessive data with no return response.

Anomalous traffic from ESXi host management daemons (like hostd or vpxa) embedding non-standard payloads in management protocols (e.g., HTTPS) or beaconing behavior.