value:  KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic. ;; Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method evading SSL man-in-the-middle decryption attacks. ;; Okrum mimics HTTP protocol for C2 communication while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests. ;; SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol. ;; TAINTEDSCRIBE has used FakeTLS for session authentication.;;WellMass malware obfuscates it's C2 communications through abusing TLS via a hardcoded certificate. ;; APT40 includes API keys for Dropbox in every command when uploading stolen data in an attempt to mask the activity as legitimate. ;; Winnti (APT41) utilises the Crosswalk backdoor which abuses FakeTLS to obfuscate C2 traffic. 
name: Data Obfuscation: Protocol Impersonation