Procedure examples

Squirrelwaffle has encoded its communications to C2 servers using Base64.

HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.

RDAT can communicate with the C2 via base32-encoded subdomains.

Okrum has used base64 to encode C2 communication.

RustyWater has encoded collected data with Base64.

Fysbis can use Base64 to encode its C2 traffic.

PowerShower has the ability to encode C2 communications with base64 encoding.

Kazuar encodes communications to the C2 server in Base64.

GLASSTOKEN has hexadecimal and Base64 encoded C2 content.

Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.

CORESHELL C2 messages are Base64-encoded.

DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.

Bisonal has encoded binary data with Base64 and ASCII.

S-Type uses Base64 encoding for C2 traffic.

SeaDuke C2 traffic is base64-encoded.

BS2005 uses Base64 encoding for communication in the message body of an HTTP request.

Mongall can use Base64 to encode information sent to its C2.

LockBit 3.0 can Base64-encode C2 communication.

Carbanak encodes the message body of HTTP traffic with Base64.

Elise exfiltrates data using cookie values that are Base64-encoded.

Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.

Saint Bot has used Base64 to encode its C2 communications.

Chaes has used Base64 to encode C2 communications.

CharmPower can send additional modules over C2 encoded with base64.

SMOKEDHAM has encoded its C2 traffic with Base64.

Mori can use Base64 encoded JSON libraries used in C2.

QUADAGENT encodes C2 communications with base64.

KONNI has used a custom base64 key to encode stolen data before exfiltration.

gh0st RAT has used Zlib to compress C2 communications data before encrypting it.

DnsSystem can Base64 encode data sent to C2.

A JHUHUGIT variant encodes C2 POST data base64.

down_new has the ability to base64 encode C2 communications.

Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.

RedLine Stealer has used Base64 to encode command and control traffic.

OopsIE encodes data in hexadecimal format over the C2 channel.

RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.

QUIETCANARY can base64 encode C2 communications.

PHPsert can use Base64-encoded values in C2 communications.

StrelaStealer utilizes a hard-coded XOR key to encrypt the content of HTTP POST requests to command and control infrastructure.

PULSECHECK can base-64 encode encrypted data sent through C2.

Kapeka utilizes JSON objects to send and receive information from command and control nodes.

Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.

SpeakUp encodes C&C communication using Base64.

WARPWIRE can Base64 encode captured credentials with `btoa()` prior to sending to C2.

Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.

SUNBURST used Base64 encoding in its C2 traffic.

Cobian RAT obfuscates communications with the C2 server using Base64 encoding.

Valak has returned C2 data as encoded ASCII.

Samurai can base64 encode data sent in C2 communications prior to its encryption.

OSX_OCEANLOTUS.D has used `zlib` to compress all data after 0x52 for the custom TCP C2 protocol.