well the evasion part is pretty huge diff.

If you're referring to what is mentioned in this post: https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a , I'm not sure "We use HTTP2 and TLS" is that significant of a difference. If there was some elaborate system in place for evasion, sure, but this is just "using a new, but standard, protocol before everybody else understands it yet". Heck, just the fact it's using TLS is about 90% of the evasion; HTTP2 is just icing on the cake.

A more significant difference I was thinking of is that ansible et al are more focused on getting the system into a certain state, whereas a C&C server is likely to be oriented around executing commands and keeping certain tasks running. However, since the way you get a system into a certain state is by executing commands, well, the technical differences aren't that significant. Most of that difference would be in organization of the "UI" layer, rather than under the hood.

My take is that HTTP/2 is more significant than you might expect, primarily because it is a full duplex protocol (unlike the typical request / response of HTTP/1). This makes it like a more efficient websocket, so the C2 bits can move faster than a polling based approach. That said, this makes it easier to detect.

They are looking at adding domain fronting :)