Domain fronting and CDN abuse - Malleable C2 profiles mimicking legitimate services - DNS-over-HTTPS for C2 - Encrypted channels with legitimate certificates - Traffic timing manipulation