Malleon tool automates C2 traffic disguise for Cobalt Strike

A new open-source tool, Malleon, automates the creation of Malleable C2 profiles for Cobalt Strike, using real captured HTTP/HTTPS traffic from legitimate apps to disguise command-and-control communications. The technique makes malicious traffic harder to detect, raising concerns for European cybersecurity defenders. The developer stresses it is for authorized red-team testing only.

Bottom line — Malleon's automation could lower the skill barrier for evading network defenses, per the DEV Community article.

Go deeper (5)

• Malleon captures traffic from a legitimate binary and builds a Malleable C2 profile, populating http-* blocks while preserving operator settings, per the DEV Community article.
• The tool's --body-camouflage option wraps encrypted beacon data in real response content, embedding it between legitimate text, per the DEV Community article.
• Malleable C2 profiles let operators customize beacon traffic to mimic sites like Google or Microsoft, with the only giveaway being a mismatched Host header, per Hackmag.
• The DEV Community article notes that default profile paths can be used to search for indicators of compromise, unless the attacker uses a custom profile.
• The tool is intended for security professionals in authorized environments; misuse is illegal and strictly prohibited, per the DEV Community article.

Read the reporting