Black Hat

Black Hat USA 2025 | Ghost Calls: Abusing Web Conferencing for Covert Command & Control

The Black Hat USA 2025 talk introduced “ghost calls,” a technique that hijacks commercial web‑conferencing platforms to create covert, short‑term command‑and‑control (C2) channels. Presenter Adam Crosser explained that traditional C2 methods—socks proxies, long‑term implants, or peer‑to‑peer tunnels—often suffer from latency, limited reach, or lack of trust within tightly controlled enterprise networks. He argued that an ideal short‑term C2 must combine low latency, high throughput, broad reach, and use of trusted, allow‑listed infrastructure. Crosser evaluated several candidate vectors—DNS‑over‑HTTPS, cloud file storage, custom domains, and messaging apps—against these criteria, finding each lacking in either latency, throughput, or trust. Web‑conferencing services, however, are engineered for real‑time human interaction, delivering sub‑second latency and multi‑megabit bandwidth while being universally permitted and exempted from deep packet inspection in most corporate VPN and proxy configurations. This makes them a perfect fit for rapid, stealthy C2 payload delivery. The speaker dissected the underlying protocols, showing how Zoom, Microsoft Teams, and Google Meet employ WebRTC, STUN/TURN relays, and custom RTP wrappers. He demonstrated that when direct UDP egress is blocked, these clients automatically fall back to TLS‑wrapped WebSocket tunnels that traverse corporate web proxies unimpeded. By capturing the WebRTC handshake—offer/answer exchange, DTLS key negotiation, and SRTP streams—an attacker can embed command data within legitimate media streams, effectively turning a video call into a covert tunnel. The implication for defenders is clear: the ubiquity and trusted status of conferencing traffic creates a blind spot that traditional network security tools often overlook. Organizations must extend inspection to WebRTC and TURN traffic, enforce strict egress policies for media ports, and consider behavioral analytics that flag anomalous data patterns within video‑conference sessions. Failure to adapt could allow adversaries to exfiltrate data or control compromised hosts without triggering conventional alerts.