Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study conducts the first longitudinal analysis of covert communication channels (CCs) in the Android malware ecosystem, revealing a significant increase in CC usage from 0.30% in 2012 to 50% in 2025 across a dataset of 3.5 million malware samples. By employing a multistage pipeline that integrates both static and dynamic analysis, the researchers identified 288,000 APKs across 511 malware families utilizing CCs, with dynamic analysis uncovering 19,308 unique IP addresses linked to these channels. The findings highlight the evolving strategies of malware, including the frequent switching of CCs, underscoring the growing sophistication of malware evasion techniques.
Covert communication channels in Android malware have surged from 0.30% to 50% in just over a decade, revealing a dramatic shift in evasion tactics.
Proxies, VPNs and Tor have long helped the privacy community and users in censored regions to fight censorship. However, the same tools can be maliciously exploited by malware and botnets to conceal their communication to external command and control servers. Despite being a critical concern fueled by the proliferation of malware based attacks, no longitudinal studies have analyzed how malware applications use covert channels (CC) to evade detection. We fill this gap by performing the first study of the usage of covert channels in the Android malware ecosystem. To that end, we develop a multistage pipeline that combines static and dynamic analysis to investigate both system and network-level features. We applied this pipeline on a corpus of 3.5M Android malware spanning 2009 to July 2025. Our carefully crafted static validation rules uncovered 288K APKs that used CCs spanning 511 malware families and CC usage growing exponentially from 0.30\% (2012) to 50\% (2025). Overall, in dynamic analysis, we identified 19,308 unique IP addresses being contacted in 85 countries, out of which we were able to explicitly validate the presence of CCs for 59 IP addresses across 17 countries. Further, we performed a longitudinal dataset study spanning over 16 years for CC based malware and found that CC usage has evolved, \textit{e.g.,} some malware adopted by using more than one CCs; others switched between them periodically (one family switched CC usage 40 times from 2019 to 2025).