When Malicious Traffic Blends In: Trojan-Proxies Leveraging DNS Over HTTPS for Stealth

Protocol tunneling enables malware and threat actors to stealthily communicate with their command-and-control (C2) servers by encapsulating malicious traffic within legitimate protocols, helping evade detection. In the past few months, we have detected several weaponized software with a trojan-proxy capable of solving C2 server via DoH (DNS over HTTPS) making malicious traffic indistinguishable from legitimate HTTPS web traffic.