“This type of connection, using a custom protocol instead of existing protocols like HTTP, is what we refer to as hidden tunnels and is used for command and control of remote systems, as well as for data exfiltration,” said Chris Morales, head of security analytics at Vectra.