Blog

Ransomware Data Breach Protection Cyber Security Email Phishing Encrypted Technology, Digital Information Protected Secured

When attackers tunnel covert channels through trusted infrastructure - like Cloudflare protected DNS-over-HTTPS or multimedia platforms - they bypass even the most hardened Fortinet and Checkpoint deployments.The result?✅ No alerts. ✅ No visibility. ✅ No suspicion - just normal-looking traffic.Here’s a curated list of tools and techniques that make this possible. Each leverages covert channel methods - some obscure, some highly advanced - to exfiltrate data or communicate with C2 infrastructure right under defenders’ noses.<h3>🔧 Kernel &amp; Driver-Level Covert Channels</h3>1. 🧬 cat-soup &nbsp; ➡️ eBPF-based Linux rootkit. Exfiltrates via kernel-level system call hijacking. &nbsp; GitHub: https://github.com/chumachok/cat-soup2. 🕓 NTPTunnel &nbsp; ➡️ Tunnels C2 over Network Time Protocol (NTP) messages. Low visibility. &nbsp; GitHub: https://github.com/ricklahaye/NTPTunnel3. 📡 NetworkCovertChannels &nbsp; ➡️ Protocol-hopping, protocol-switching, and active warden evasion techniques. Research-grade suite. &nbsp; GitHub: https://github.com/cdpxe/NetworkCovertChannels/tree/master<h3>🧬 Protocol Steganography</h3>4. 📜 x509 &nbsp; ➡️ Encodes data in TLS certificates (X.509 extensions). Invisible during HTTPS handshakes. &nbsp; GitHub: https://github.com/ProbieK/x5095. 🌐 IPv6-Attacks-and-Covert-Channels &nbsp; ➡️ Covert data in IPv6 extension headers, flow labels, and options. &nbsp; GitHub: https://github.com/n3m351d4/IPv6-Attacks-and-Covert-Channels6. 📘 IPv6teal &nbsp; ➡️ Exfiltration using IPv6 Destination Options and Hop-by-Hop headers. &nbsp; GitHub: https://github.com/christophetd/IPv6teal7. 🧬 DNSExfiltrator &nbsp; ➡️ Hides data in DNS requests (labels, TTLs, responses). Works with DNS-over-HTTPS. &nbsp; GitHub: https://github.com/Arno0x/DNSExfiltrator8. 🌐 WebDavDelivery &nbsp; ➡️ Uses HTTP WebDAV methods (PROPFIND) to deliver payloads via XML fields. &nbsp; GitHub: https://github.com/Arno0x/WebDavDelivery9. 📡 pingtransfer &nbsp; ➡️ Covert ICMP tunnel. Hides payloads in ping echo/reply packets. &nbsp; GitHub: https://github.com/yilmi/pingtransfer10. 🔧 Simple Packet Sender &nbsp; ➡️ Craft custom raw packets. Great for prototyping covert headers or timing channels. &nbsp; Website: https://sites.google.com/site/simplepacketsender/<h3>📶 Wireless &amp; Network Tunneling</h3>11. 📡 GhostTunnel-Go &nbsp; ➡️ Covert Wi-Fi C2 using 802.11 management frames. Cross-platform. &nbsp; GitHub: https://github.com/AmyangXYZ/GhostTunnel-Go12. 👻 GhostTunnel (C/C++) &nbsp; ➡️ Native implementation for stealthy layer-2 exfiltration over Wi-Fi. &nbsp; GitHub: https://github.com/PegasusLab/GhostTunnel13. 📶 WiFi_CCC &nbsp; ➡️ Chat-style covert channel using SSID beacon timing. &nbsp; GitHub: https://github.com/yadox666/WiFi_CCC/tree/master14. 🔁 WiFi_Reconnection_CovertChannel &nbsp; ➡️ Encodes bits via reconnection timing to APs. &nbsp; GitHub: https://github.com/NIoSaT/WiFi_Reconnection_CovertChannel<h3>🎧 Cloud &amp; Multimedia Channels</h3>15. 🎥 covert-tube &nbsp; ➡️ Encodes C2 data in YouTube video descriptions, metadata, or frames. &nbsp; GitHub: https://github.com/ricardojoserf/covert-tube16. 🎵 Pileus &nbsp; ➡️ SoundCloud-based C2 using steganography in audio tracks. &nbsp; GitHub: https://github.com/Bojak4616/Pileus<h3>🛡️ Detection &amp; Research</h3>17. 🔍 nefias &nbsp; ➡️ Network anomaly detection engine focused on detecting covert and stego channels. &nbsp; GitHub: https://github.com/cdpxe/nefias18. 📚 Research – “Covert Channels in IPv6” (Lucena et al.) &nbsp; ➡️ Landmark academic paper on IPv6 covert channel design. &nbsp; PDF: https://link.springer.com/content/pdf/10.1007/11767831_10.pdf19. 📚 ACM Covert Channel Paper &nbsp; ➡️ Early formalization of covert channel classification. &nbsp; PDF: <a href="https://dl.acm.org/doi/pdf/10.1145/2018436.2018518" data-mce-href="https://dl.acm.org/doi/pdf/10.1145/2018436.2018518">https://dl.acm.org/doi/pdf/10.1145/2018436.2018518</a> <h3>⚔️ Defensive Takeaways</h3><ul><li>🔁 Covert channels span all OSI layers: From layer 2 (Wi-Fi beacons) to layer 7 (TLS x509, DNS).</li><li>☁️ Trusted cloud services are abused: DNS-over-HTTPS, YouTube, SoundCloud, etc.</li><li>📊 Anomaly-based detection works: Tools like nefias use statistical header and timing analysis.</li><li>🧼 Protocol normalization: Strip or rewrite optional headers to disrupt steganographic channels.</li></ul>

Mastering Covert Channels to Become Invisible

Image of obscured secret computer hacker programmer youth wearing hoodie with dark programming computer code background, concept for cyber war hacking technology, encryption coding, Internet crime, software programming, digital data analysis

It's not just the bad guys that can hack - our team recently uncovered the real IP address of the server hosting Medusa Locker's blog and negotiation site, by exploiting a vulnerability in their blog.Medusa Locker primarily targets healthcare, education, and manufacturing sectors, with hundreds of reported attacks since its emergence in 2019. The group operates a Tor-based leak site to pressure victims, where they publish stolen data from organizations that refuse to pay.🧨 After uncovering a high severity vulnerability in Medusa Locker's ransomware blog - we successfully escalated and obtained the true IP address of their hidden host.<figure id="figure-zqtyjya97nm9he3na9"><img id="zqtyjya97nm9he3na9" src="https://cdn.durable.co/blocks/13Ynvsk7ytP0IEZxB7LWDLnK7gGuviseWhZ8S5TLHUl4NHfF0YtXODvjtQKEjs1h.png" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 16/9; object-position: 0% 50%;" data-corners="default" data-aspect="16:9" data-caption="Figure 1 - Censys results and real site exposed." data-positionX="0%" data-positionY="50%" data-fullWidth="false"/><figcaption class="body-normal text-gray-500 mt-2">Figure 1 - Censys results and real site exposed.</figcaption></figure>📍 Our analysis reveals that the server is located in Saint Petersburg, Russia, hosted by Selectel, one of the largest Russian providers, known for accepting payments in Bitcoin and Litecoin.⏳ 𝘍𝘰𝘭𝘭𝘰𝘸 𝘰𝘶𝘳 𝘱𝘢𝘨𝘦 𝘵𝘰 𝘴𝘵𝘢𝘺 𝘶𝘱𝘥𝘢𝘵𝘦𝘥 𝘧𝘰𝘳 𝘮𝘰𝘳𝘦 𝘦𝘹𝘱𝘰𝘴𝘦𝘴, 𝘢𝘯𝘥 𝘵𝘰 𝘣𝘦 𝘵𝘩𝘦 𝘧𝘪𝘳𝘴𝘵 𝘵𝘰 𝘬𝘯𝘰𝘸 𝘢𝘣𝘰𝘶𝘵 𝘰𝘶𝘳 𝘶𝘱𝘤𝘰𝘮𝘪𝘯𝘨 𝘢𝘥𝘷𝘢𝘯𝘤𝘦𝘥 𝘥𝘢𝘳𝘬 𝘸𝘦𝘣 𝘪𝘯𝘵𝘦𝘭𝘭𝘪𝘨𝘦𝘯𝘤𝘦 𝘤𝘰𝘶𝘳𝘴𝘦!

Deanonymizing Medusa Ransomware's Onion Site

Computer hacker and computer software in the dark

Our team has conducted threat intelligence in the dark web space and identified a technique used to expose the real IP addresses, behind Cloudflare protected sites using authenticated origin pulls.⛓️‍ One of the first targets is "darknetlinks[.]info" - a link collection for dark web forums, marketplaces, exchanges and others.Our investigation showed that the site is using Cloudflare services to protect on a DNS-level, and on a server-level using authenticated origin pulls (AOP), to restrict server traffic only to Cloudflare servers.🗝️ Conducting certificate intelligence using Censys, our team identified their origin certificate with the fingerprint "02a43b2d77464a269fc32fccf79699dea82569215c37134331f7aaba54d63052" and one host "146[.]19[.]143[.]203" server, which serves their dark web link collection.<figure id="figure-wmnuqqlxrm9h7k6p7"><img id="wmnuqqlxrm9h7k6p7" src="https://cdn.durable.co/blocks/27sue0oWpm8N6fqwxpd7tOq4RjiesIn5pSEwHeS1HlJ1aCzhpJd1CceFWhINllND.jpg" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 16/9; object-position: 0% 0%;" data-corners="default" data-aspect="16:9" data-caption="Figure 1 - Censys Results for 146[.]19[.]143[.]203." data-positionX="0%" data-positionY="0%" data-fullWidth="false"/><figcaption class="body-normal text-gray-500 mt-2">Figure 1 - Censys Results for 146[.]19[.]143[.]203.</figcaption></figure>🛡️ The technique and exposed target are part of Covert Security's upcoming CS-ADWI (Advanced Dark Web Intelligence) course, featuring topics such as...<ul><li>Monero transaction deanonymization through honeypot nodes.</li><li>Hidden service deanonymization on the dark web.</li><li>Deanonymization of Cloudflare protected services on the clear web.</li></ul>🎉 𝘚𝘵𝘢𝘺 𝘵𝘶𝘯𝘦𝘥 𝘧𝘰𝘳 𝘮𝘰𝘳𝘦 𝘶𝘱𝘥𝘢𝘵𝘦𝘴 𝘢𝘯𝘥 𝘦𝘹𝘱𝘰𝘴𝘦𝘴, 𝘢𝘴 𝘰𝘶𝘳 𝘥𝘢𝘳𝘬 𝘸𝘦𝘣 𝘳𝘦𝘴𝘦𝘢𝘳𝘤𝘩 𝘦𝘹𝘱𝘢𝘯𝘥𝘴.

Blog

Mastering Covert Channels to Become Invisible

Deanonymizing Medusa Ransomware's Onion Site

Exposing the IP Address of a Dark Web Link Collection