Beaconing Definition

What is Beaconing?

In cybersecurity, the term beaconing refers to a callback from malware on an infected machine to a command and control (C2) server. This beaconing can be used to inform the C2 server of the malware’s presence, request additional instructions, or exfiltrate information from the infected system.

What is Beaconing?

In many malware attacks, the attackers don’t know which systems their malware is infecting. For example, if malware is attached to a phishing email, the computer infected by it will be the one where the recipient opens the infected attachment. Not all phishing emails will succeed, and, for those that do, the system infected by the malware is unpredictable.

Beaconing is a mechanism that malware operators use to identify the systems that they’ve successfully infected with malware. After the malware is running on the system, it will eventually reach out to a C2 server providing information about the infected system and requesting further instructions.

Often, these beaconing packets will be designed to look benign and blend into normal traffic. Some of the ways that malware might do this include:

• DNS Queries: The malware may make a DNS request for an attacker-controlled domain. The malware operator will run the DNS server, which will interpret the information contained within the DNS query and may include additional information in the response.
• HTTPS Traffic: Encrypted HTTPS web traffic is another common choice for beaconing. Companies commonly allow outbound HTTPS requests for web browsing, so the malware can make a request to an attacker-controlled website with any exfiltrated data hidden in the encrypted bodies of the packets.

Beaconing can be used to provide more than that initial hello message. Beaconing is also used to request instructions from the C2 server or to exfiltrate information collected from the infected system.

How Malware Conceals Beacon Traffic

Beacons are designed to enable the malware operator to identify and communicate with systems that were infected by their malware. These same beacons could be invaluable to incident responders since they highlight which systems need malware remediation and the data that the attacker has stolen.

To prevent this and ensure that their beacons don’t give away their presence, malware uses various techniques to make beacons more difficult to detect. These include:

• Irregular Intervals: Malware commonly waits before sending out the first beacon and may send beacons at irregular intervals. This makes beaconing more difficult to detect because it doesn’t have a regular cadence and complicates incident response because the beacon doesn’t give away the attack vector by going out right after infection.
• Domain Generation Algorithms (DGAs): Organizations commonly use IP address and domain blocklists to prevent communication with known-bad domains, including known C2 servers. Malware and C2 servers may run DGAs in which the server generates and registers new, random domains and the malware independently calculates them and sends traffic to them. The use of DGAs enables the malware to evade domain blocklists.
• Encryption and Encapsulation: As mentioned before, malware might use data encryption or encapsulation to conceal beacons and data exfiltration. DNS, HTTPS, or other traffic may include additional fields or content containing information being transmitted to the C2 server.

Conclusion

Malware uses beaconing to communicate with C2 servers. In addition to announcing the malware’s presence on infected computers, these stealthy messages are also used to send data or requests for instructions to a C2 server.