Binary C&C Over HTTP
Summary: A Cisco Talos researcher, presenting at the CARO 2011 Workshop in Prague, found that 0.8% of roughly 1.5 million malware sandbox PCAPs showed pure binary command-and-control channels sent over HTTP without headers on port 80. The technique drew attention after the Night Dragon trojan (Snort SIDs 18458/18459) in February, and Talos said it was working with the Snort team on generic detection while recommending SID 18492 and its blocklist.rules and botnet-cnc.rules categories.
Bottom line: Headerless binary traffic on port 80 blends into the busiest port on any network, where nearly every firewall permits outbound connections and NetFlow offers little help - so the same needle-in-a-haystack gap that hid Night Dragon can hide other malware families in your environment.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026