Covert communications are hidden or disguised data exchanges designed to avoid detection by security tools and human analysts. Instead of using an obviously malicious channel, an attacker may bury command-and-control messages, exfiltrated data, or proxy instructions inside traffic that looks routine. This can include abusing legitimate protocols, encrypting payloads, changing packet timing, or blending with normal application behavior.
In cyber security, covert communications matter because visibility depends on recognizing what is normal. If a network allows services such as DNS, HTTPS, or STUN, malware can try to hide inside them and appear harmless at first glance. Defenders look for out-of-pattern volumes, unusual destinations, odd timing, and devices using protocols they do not normally need. Detecting covert communications often requires combining network baselines, endpoint telemetry, and protocol-aware inspection.