T1001: Data Obfuscation
Adversaries may obfuscate command and control traffic to make it more difficult to detect.[1] Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Analyst context for executives and security teams
Data Obfuscation matters because it can let command-and-control traffic look ordinary enough to evade quick review. For leaders, the issue is not just whether traffic is encrypted, but whether the organization can recognize suspicious C2 when commands are hidden with junk data, steganography, or protocol/service impersonation across ESXi, Linux, macOS, and Windows environments.
Executive priority
Treat this as a resilience and incident-readiness question: can the SOC prove it has network visibility and boundary controls capable of finding disguised C2 before an intrusion becomes prolonged? The ATT&CK relationships show this behavior is associated with multiple documented malware families, tools, and campaigns, so it should influence detection engineering priorities, managed detection requirements, and evidence requested during audits of monitoring coverage.
Technical view
ATT&CK lists this as a command-and-control technique with no official detection text, but it is linked to detection strategy DET0053, Detect Obfuscated C2 via Network Traffic Analysis. Defenders should validate coverage against the three related sub-techniques: junk data, steganography, and protocol or service impersonation. Practical validation should focus on whether network analytics can distinguish abnormal protocol structure, unusual payload patterns, suspicious file-based communications, and traffic that claims to be a legitimate protocol or service but does not behave like one. Correlate network findings with host, process, and asset context on supported platforms where available.
Likely telemetry
- Network flow records and connection metadata from endpoints, servers, and ESXi-hosted workloads where available
- Packet capture or protocol inspection data for suspicious sessions
- Proxy, firewall, and network intrusion detection/prevention logs at network boundaries
- DNS and destination reputation/context logs used to explain outbound C2 paths
- Endpoint or EDR context tying suspicious network sessions to processes, users, and hosts
Detection direction
- Use DET0053 as the primary validation direction: confirm network traffic analysis can flag obfuscated or malformed C2, not just known indicators.
- Tune for protocol/service impersonation by comparing claimed protocol behavior with actual session characteristics; expect false positives from unusual but legitimate applications.
- Look for junk-data patterns or abnormal padding that may defeat simple string matching or decoder-based detections.
- For steganography-related cases, ensure investigations can connect suspicious file transfers with network destinations and host activity.
- Avoid relying only on content inspection; obfuscation may reduce the value of signatures unless supported by metadata, behavioral baselines, and cross-source correlation.
Mitigation priorities
- Apply M1031 Network Intrusion Prevention where appropriate: use intrusion detection signatures to block traffic at network boundaries.
- Prioritize boundary monitoring and prevention for outbound traffic paths most likely to carry C2.
- Pair prevention controls with SOC procedures for triaging suspicious but not fully decoded traffic.
- Maintain tested response playbooks for isolating hosts when disguised C2 is suspected but payload content cannot be confidently interpreted.
- Use the sub-technique breakdown to guide control testing: junk data, steganography, and protocol/service impersonation should each be considered during detection validation.
Analyst notes and limits
The relationship set includes multiple software examples and one campaign/group context, indicating this is a broadly relevant C2 evasion behavior rather than a single-tool artifact. The strongest defensive value comes from proving that network monitoring can recognize suspicious behavior even when command content is hidden or made to look routine.
MITRE provides no official detection text for T1001 in the supplied fields. This take is based on the official description, platforms, tactic, external references, mitigation M1031, detection strategy DET0053, and listed relationships. Local architecture, logging depth, encryption handling, and approved application behavior are required to determine actual coverage.
Data Obfuscation
Adversaries may obfuscate command and control traffic to make it more difficult to detect.[1] Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1001.001 | Junk Data Sub-technique | Junk Data subtechnique of this object. |
| Enterprise | T1001.003 | Protocol or Service Impersonation Sub-technique | Protocol or Service Impersonation subtechnique of this object. |
| Enterprise | T1001.002 | Steganography Sub-technique | Steganography subtechnique of this object. |
Groups, software, and campaigns
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
S1183: StrelaStealer
StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.[1][2][3][4]
S0439: Okrum
S9001: SystemBC
SystemBC is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and control and facilitate follow-on activity, including ransomware deployment.SystemBC executes a variety of tasks including setting up SOCKS5 proxies, maintaining persistence, ingesting malicious files, and handing C2 communication. SystemBC was first detected in 2018, and has been used by Wizard Spider since at least 2020, and by FIN7 since at least 2022.[1][2][3][4][5]
S0533: SLOTHFULMEDIA
SLOTHFULMEDIA is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017.[1][2] It has been used to target government organizations, defense contractors, universities, and energy companies in Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe.[3][4]
In October 2020, Kaspersky Labs assessed SLOTHFULMEDIA is part of an activity cluster it refers to as "IAmTheKing".[4] ESET also noted code similarity between SLOTHFULMEDIA and droppers used by a group it refers to as "PowerPool".[5]
S1100: Ninja
Ninja is a malware developed in C++ that has been used by ToddyCat to penetrate networks and control remote systems since at least 2020. Ninja is possibly part of a post exploitation toolkit exclusively used by ToddyCat and allows multiple operators to work simultaneously on the same machine. Ninja has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by Samurai.[1]
S0682: TrailBlazer
TrailBlazer is a modular malware that has been used by APT29 since at least 2019.[1]
S1044: FunnyDream
FunnyDream is a backdoor with multiple components that was used during the FunnyDream campaign since at least 2019, primarily for execution and exfiltration.[1]
S1111: DarkGate
DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]
S1120: FRAMESTING
FRAMESTING is a Python web shell that was used during Cutting Edge to embed into an Ivanti Connect Secure Python package for command execution.[1]
S9003: evilginx2
S0495: RDAT
S0381: FlawedAmmyy
FlawedAmmyy is a remote access tool (RAT) that was first seen in early 2016. The code for FlawedAmmyy was based on leaked source code for a version of Ammyy Admin, a remote access software.[1]
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | fe43773109dd… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Bitdefender FunnyDream Campaign November 2020
Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
Open source URL -
[2]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL -
[3]
mitre-attack T1001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.