Spoofed TLS Certificate

Attackers communicate with compromised devices through command-and-control (C&C) techniques. One technique is for malware, installed on the compromised device, to connect to a C&C server. Attackers can disguise these connections by spoofing the identity of the C&C server as a legitimate owner of a well-known domain (such as google.com). To accomplish this, the attacker creates a self-signed TLS certificate for the well-known domain. When the malware attempts to establish the connection, the C&C server presents the spoofed certificate. After the connection is established, C&C-related traffic appears to be sent to a legitimate domain, enabling the traffic to bypass firewalls and intrusion detection and prevention systems.