A story from RSAC 2019 on how domain fronting is used to disguise communications between an infected machine and a command server.