I'm looking for state-sponsored spyware that has the following features.

The spyware should be split into three or more parts. There are two parts on the host/phone, and a third part on the home router. The two parts on the host are:

  • a piece at ring0 joined in the kernel to hide traces
  • another piece is in userland and injected in the browser to communicate with the attacker.

The full implant is fileless and the PC is infected while it connects to the internet by the router. The part in the router is file-less too and is infected from the isp infrastructure.

The information is exfiltrated in a covert channel through a benign and existent encrypted stream. I mean, for example, I'm connected to Facebook, the exfiltered data are injected into the Facebook stream data and then extracted from the router part of the implant. In this way, if I run a sniffer on the cable between router and PC, I see only encrypted packets to Facebook, and then from my point of view, everything looks benign.

When the data goes to the router they are extracted (the router has the private key and can decrypt the encrypted data), re-assembled and sent to the C2C so that the data sent to Facebook are totally clean.

This kind of implant should not trigger any alert on snort or other IDS.

I cannot run a sniffer after the router because there is an ISP.

This implant can be cross-platform and cross-device: window/linux/mac/bsd/ios/android and PC/router/phone.

  1. Is this kind of implant theoretically possible?
  2. Have you ever heard of anything like this?
  • 1
    This is a ton of really, really specific details, and I'm not sure why all of these details need to exist together. What problem are you actually trying to solve? This is really looking like another one of your X/Y problems.
    – schroeder
    Jun 21 at 8:26
  • If you are asking if malware can use legitimate traffic to "tunnel" hidden traffic, then that's far easier to answer.
    – schroeder
    Jun 21 at 9:04
  • @schroeder why don't you stay on the question ? Yes this looking like antoher one of my x/y problems, but you don't know what I've done to check all the possible hypothesis then please do not have a presumptuous attitude, just because you don't know anything. you make assumptions that you cannot make because you do not have enough elements to make it. You reason by hypothesis according to your previous experience and since these kinds of questions are asked by beginners then you come to the same conclusion. Jun 21 at 9:35
  • I cannot make a real question because it's too generic and also to proof why I'm making this question I'd write tons of pages and personal information which I don't want it. Then you're asking me to make a question I cannot make. So I need to make little question to have enough pieces of the puzzle to solve the problem. Jun 21 at 9:39
  • "This is looking like" is a phrase that proposes a conclusion. It is not a conclusion. So slow down. Improve the question, don't attack me. I'm telling you what this looks like to give you a chance to improve it. And you say that you can't improve it, so, we are where we are. The question is either unanswerable or any answer is irrelevant.
    – schroeder
    Jun 21 at 9:42


Browse other questions tagged or ask your own question.