⚠️ Overview

Meek is not a traditional malware family but a pluggable transport for the Tor anonymity network, originally developed by the Tor Project and first released in 2012 as part of the Tor Browser Bundle. It operates by using domain fronting techniques to disguise encrypted traffic as legitimate HTTPS connections to popular content delivery networks (CDNs) like Google App Engine, Amazon AWS, or Microsoft Azure, effectively bypassing censorship and deep packet inspection. Because of this capability, multiple threat actors have repurposed Meek as a covert communication channel for malware command-and-control (C2), including variants of DarkComet, PlugX, and certain Chinese cyberespionage tools documented by the Citizen Lab and MITRE ATT&CK (technique T1090.003 for multi-hop proxy).

🔧 Technical Capabilities

Meek works by encapsulating Tor traffic inside HTTPS requests to a front-domain controlled by a CDN, which then forwards the traffic to a hidden bridge server, a technique known as domain fronting. The transport uses a custom HTTP/2-based protocol and can automatically recover from connection drops, making it resilient for long-lived C2 sessions. For malware operators, Meek provides end-to-end encryption, traffic obfuscation, and the ability to blend into normal web traffic, evading signature-based detection and IP blacklisting. It does not require any special outbound ports—only standard HTTPS (port 443)—and can be bundled directly into malware binaries as a static library. Persistence mechanisms are not inherent to Meek itself, but adversaries often pair it with droppers that install background services or scheduled tasks. Some variants use randomized User-Agent strings mimicking common browsers to further evade fingerprinting.

📜 History & Notable Incidents

The Tor Project released Meek in March 2012 as a response to increasing censorship of Tor traffic in countries like China and Iran. In 2015, the Citizen Lab reported that APT groups, including those linked to the Chinese government, were using Meek in conjunction with the PlugX remote access trojan to exfiltrate data from high-value targets, notably government and defense sectors. A 2018 report by Trend Micro identified a variant of DarkComet that embedded Meek to establish persistent C2 channels, and in 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) advised blocking domain fronting as a mitigation against state-sponsored actors. No CVEs have been directly assigned to Meek itself, as it is a legitimate tool, but its misuse has been featured in numerous advisories from FireEye and CrowdStrike.

🔍 Detection Indicators

Network IOCs for Meek usage include HTTPS traffic to CDN endpoints with unusual HTTP headers like X-Meek-Client or X-Meek-Server (though these are often stripped), and connection patterns showing periodic keep-alive requests every 10–30 seconds. Known User-Agent strings such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 are common but not unique. Behavioral signatures include repeated DNS lookups for CDN front domains and anomalous TLS handshake patterns. No fixed file hashes exist for Meek as a transport because it is compiled per-application; however, the Tor Project publishes official GPG-signed binaries. Malware variants may be identified by the presence of the meek-client or meek-server filenames in process lists.

☠️ Risk & Impact

When weaponized, Meek enables persistent, undetected exfiltration of sensitive data from compromised networks, often bypassing enterprise firewalls and DLP systems. Impacted sectors include government, military, telecommunications, and critical infrastructure, with documented losses from intellectual property theft and espionage campaigns. Financial losses are difficult to quantify directly, but associated attacks—such as the 2019 TTPs used against the Mongolian government—resulted in years-long compromises. The covert nature of Meek significantly delays incident response, increasing remediation costs.

🛡️ Mitigation

Defensive measures include implementing SSL inspection to detect domain fronting, blocking known CDN front domains associated with Meek (e.g., *.appspot.com from non-Google services), and using network monitoring rules from the Sigma project (e.g., posix_fd_monitor). Organizations should also deploy endpoint detection tools that flag outbound HTTP/2 traffic patterns consistent with pluggable transports and review CISA’s 2020 alert on domain fronting for updated indicators.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.