Cisco’s Encrypted Visibility Engine Detects AMMYY RAT Traffic at Splunk .conf

At the recent Splunk .conf conference, Cisco showcased a real‑time detection of the AMMYY remote‑access trojan (RAT) traffic using its Encrypted Visibility Engine (EVE) and Endace PCAP capture technology. The demonstration proved that suspicious traffic can be identified even when it traverses TLS‑encrypted channels.

EVE works by analysing metadata and traffic patterns in encrypted flows, while Endace’s high‑performance packet capture records full packet data for forensic review. Together they flagged the AMMYY payload as anomalous, allowing security teams to intervene without the need to break the encryption.

The ability to spot compromised traffic without decrypting it addresses a key challenge for Australian organisations that must balance strong security monitoring with privacy regulations such as the Australian Privacy Principles and the Telecommunications (Interception and Access) Act.

Cyber‑security experts say the technique could be especially valuable for enterprises in Darwin and broader Northern Territory, where remote‑working and satellite links increase reliance on encrypted VPNs and cloud services, making traditional inspection difficult.

For Australian IT professionals and students looking to deepen their skills in network security and encrypted traffic analysis, training providers such as Wepro Technology offer courses covering Cisco security certifications that include hands‑on labs with tools like EVE and packet capture solutions.