Security Firm Launches ETA Product That Detects C2 Without Decryption
PacketCyber EVA analyzes 24 traffic behavior indicators and classifies detections by MITRE ATT&CK, the company said, with hardware and virtual appliances due in November.
South Korean security company Ssikyu Vista launched its encrypted traffic analysis (ETA) product PacketCyber EVA on November 4, 2026, according to dailysecu.com. The product detects command-and-control (C2) communications and data exfiltration without decrypting encrypted traffic.
PacketCyber EVA analyzes traffic behavior using 24 indicators, including traffic volume, communication periodicity, connection graphs and destination rarity, instead of relying on server names or TLS fingerprints. Detection results are classified according to MITRE ATT&CK techniques.
The product only receives traffic copied via network port mirroring or a TAP, so no decryption keys or separate inline equipment are needed. It applies a metadata-based detection method conforming to NIST zero trust architecture guidelines.
In testing on 47 public malicious traffic samples, PacketCyber EVA detected 46, with the false positive rate limited to one public DNS resolver. The company said detection was maintained in ECH environments with SNI removed, across 12 QUIC C2 test conditions, and in hybrid PQC real-environment traffic.
PacketCyber EVA will first launch in November as a hardware appliance and a virtual appliance, with a cloud (SaaS) service to be offered later. Ssikyu Vista plans to target the global ETA market starting with the domestic public and financial sectors via APAC distribution channels.
Background
According to the Seoul Metropolitan Police Agency Cyber Investigation Division, a ringleader attacked 60 domestic companies over about 40 days using the AI autonomous penetration testing tool Artects, compared with 30 companies attacked in the year before AI was adopted. Data stolen from about 90 organizations including academies, hospitals and large-company affiliates exceeded 8.2 million records.
Quick answers
What is PacketCyber EVA?
It is an encrypted traffic analysis (ETA) product from Ssikyu Vista that detects C2 communications and data exfiltration without decrypting traffic, using 24 behavioral indicators.
When is PacketCyber EVA available and in what form?
It launches in November 2026 as a hardware appliance and a virtual appliance, with a cloud (SaaS) service to follow later.
How accurate is PacketCyber EVA in testing?
It detected 46 of 47 public malicious traffic samples, with a false positive rate limited to one public DNS resolver.