Comment Re:Follow the money. (Score 2) 30
One of the headaches with the modern Internet is how so much beyond just HTTPS traffic runs on destination TCP Port 443 as encrypted traffic. If the rogue device connects outbound to a command-and-control server to port 443 it can be difficult to determine what the traffic is for, particularly if the nature of the flow of traffic looks superficially like a lot of other encrypted traffic. If it's all outbound from the subscriber's connection then it may blend in with all the other non-HTTPS traffic.
If the command-and-control server operator is smart then they'll have a whole slew of IPs, even possibly using DNS with a whole bunch of DNS entries retrieved via DNS over TLS to obfuscate the domain lookups themselves, allowing them to rotate the actual IPs.
The botnet compromised endpoints don't need to use some special port or have incoming connections to them, they can do it all via pulls rather than requiring pushes.