Stop Malware That Hides in Encrypted Traffic

I’m on my third coffee of the day — so let’s talk about something that they kept CISOs up at night: Malware hiding in encrypted traffic. If you believe your run-of-the-mill antivirus or firewall catches everything, think again.

I have worked in networking and security since the early ‘90s, when firewalls were simply basic packet filters, and encryption was barely on the radar beyond the creation of VPN tunnels. And then came the Slammer worm — I was in the trenches trying to keep networks alive while that thing ripped through everything. Now take that mutant worm and fast forward to today — and we see attackers aren’t simply lobbing noisy worms over the network anymore. They’re sneaky. They turn our encryption against us, smuggling malware straight through traditional defenses.

I just got back from DefCon — I hung out for hours in the hardware hacking village, but the truth is that even the best hardware defenses will leave you dead in the water if you treat your network traffic like a black box that you don’t inspect. Let’s break it down.

What is Encrypted Malware?

In short: The hackers insert malware into encrypted traffic to evade security tools.

Legitimate encryption protocols like TLS and SSL help protect privacy, which is wonderful — until attackers hijack them. Should the attacker set their sights on the faster, cheaper, and immune-to-traditional-Malware delivery mechanism, the payload is neatly concealed behind encrypted C2 (command & control) communications that exfiltrate sensitive information and perform complex attacks without triggering an alarm.

In the old days, packet-sniffing tools (the original Ethereal, and then Wireshark) at least allowed you to see what was traversing the wire. Now? Traffic that is encrypted appears as gibberish. If you can’t see it, you can’t prevent it. Which is exactly why attackers like encryption.

How It Evades Security Tools

Why does this work so well? Because most security tools cannot inspect encrypted traffic. Here’s why attackers are winning:

• Firewalls & IDS/IPS systems: These traditional tools are based on deep packet inspection (DPI), but if traffic is encrypted they cannot look inside. That means there is simply no detection of malware.
• End-point security products: These products typically rely on scanning files and behavioral analysis to detect malware on any kind of device, but if encrypted traffic is used to deliver the malware, they may not detect the payload in time.
• DLP & traffic monitoring: The majority of data loss prevention (DLP) solutions won’t observe the exfiltration of sensitive data if it’s leaving your network within an encrypted session—unless you’re decrypting and inspecting it.

And let’s not forget:

The majority of businesses encrypt everywhere. HTTPS is standard. VPNs are default. Attackers are simply exploiting our data’s protections against themselves.

So, what’s the real issue: Security teams are wary of decryption due to privacy and compliance, and performance considerations. So that is encryption, a blind spot to date. A very, very costly blind spot.

Feature Handling: Best Decryption & Monitoring Methods

Various financial institutions that I recently assisted in updating zero-trust architecture got one thing right: You can inspect encrypted traffic securely — if done right.

Decrypt: The (somewhat) necessary evil

If you don’t want to decrypt traffic? Then be prepared to let threats go. But here’s how to do it without having it become a security nightmare:

1. Perimeter SSL/TLS Inspection
   • Introduce Network Next Generation Firewalls (NGFW) or dedicated SSL decryption appliances.
   • Focus on assets that process sensitive transactions — do not waste cycles decrypting YouTube videos.
2. Selective Decryption
   • Don’t decrypt everything. Implement policies dependent on risk levels:
   • Internal business apps? Decrypt.
   • Public banking portals? Don’t decrypt for privacy reasons.
   • Financial, legal and HR data? Proximity to those with data is extra risky to manage compliance.
3. Exceptions to Certificate Pinning
   • Some applications (banking apps, security software) utilize certificate pinning – breaking decryption might break functionality.
   • Make exception lists; adjust usability v/s security.
4. Leverage decryption logs for hunting
   • If you do decrypt, log everything. Malicious payloads often leave forensic trails that will be valuable to you in your investigation.
   • Automate the detection of anomalies on decrypted traffic, particularly to unexpected destinations.
5. Up your AI game, but don’t drink the Kool-Aid
   • I’m suspicious when vendors throw “AI-powered” on a product and expect us to make the purchase.
   • Machine learning-based traffic analysis techniques can detect anomalies in encrypted traffic, but deploy alongside SSL inspection rather than replace it.

TL;DR? If you separate the encryption from the transmission, you aren’t securing the traffic. Period.

SSL Inspection Solutions from PJ Networks

All right, time for a little firsthand insight. We have Fortinet SSL decryption deployed at PJ Networks to uncover hidden malware threats… because the traditional firewall is not enough anymore.

Why Fortinet?

• Deep SSL/TLS Inspection (without ruining performance — some tools add crazy latency)
• Dynamic threat intelligence—combines with sandboxing to examine suspicious decrypted payloads in real time.
• Integration of zero-trust, so we aren’t just arbitrarily permitting all traffic because it’s encrypted.

Recent Success:

• We transformed encrypted traffic inspection for three major banks, without any compliance gaps or inadvertent impact to customer transactions.
• One of these hackers was unaware that his malware-infected cryptocurrency miners had demons communicating through encrypted TLS tunnels — completely invisible until decrypted.
• And implemented the inspection, resulting in blocking more than 3000 hidden malicious connections in one week.

My position: If an organization is not inspecting SSL/TLS traffic right now, it’s just a matter of time before it gets compromised.

Conclusion

Cybersecurity is a perpetual game of chess. Attackers adapt; defenders respond; encryption’s a moving target. But turning a blind eye to encrypted malware is like keeping your doors locked while leaving your windows wide open — and you’re only safe if you can see your network’s interior.

Quick Take:

• Malware LOVES encrypted traffic, since most security tools can’t scan it.
• Unless you decrypt, no help from Firewalls & IDS.
• Choose selective decryption: target business-critical assets.
• PJ Networks deploys Fortinet SSL inspection — security you can’t inspect, is security you can’t secure.

Inspecting the encrypted traffic in your network? Because if you aren’t — attackers are banking on it.