Procedure examples

Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.

Ursnif has used encoded data in HTTP URLs for C2.

LAMEHUG can encode queries sent to LLMs.

After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.

H1N1 obfuscates C2 traffic with an altered version of base64.

evilginx2 can randomly generate and Base64 encode parameters in phishing links to defeat static detection.

Mythic provides various transform functions to encode and/or randomize C2 data.

During Juicy Mix, OilRig used a VBS script to send the Base64-encoded name of the compromised computer to C2.

Patchwork used Base64 to encode C2 traffic.

HAFNIUM has used ASCII encoding for C2 traffic.

MuddyWater has used tools to encode C2 communications including Base64 encoding.

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.

Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.

TA551 has used encoded ASCII text for initial C2 communications.

APT42 has encoded C2 traffic with Base64.

A Lazarus Group malware sample encodes data with base64.

APT33 has used base64 to encode command and control traffic.

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.

TrickBot can Base64-encode C2 commands.

BLINDINGCAN has encoded its C2 traffic with Base64.

Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.

Spark has encoded communications with the C2 server with base64.

Bumblebee has the ability to base64 encode C2 server responses.

BRICKSTORM has leveraged Base64 to encode C2 communications.

Torisma has encoded C2 communications with Base64.

Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.

Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.

RotaJakiro uses ZLIB Compression to compresses data sent to the C2 server in the `payload` section network communication packet.

POWRUNER can use base64 encoded C2 communications.

Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.

Misdat network traffic is Base64-encoded plaintext.

TAMECAT has encoded C2 traffic with Base64.

Some Felismus samples use a custom method for C2 traffic that utilizes Base64.

xCaon has used Base64 to encode its C2 traffic.

Gomir uses Base64-encoded content in HTTP communications to command and control infrastructure.

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server. Additionally, Emotet has used Base64 to encode data before sending to the C2 server.

Machete has used base64 encoding.

Prikormka encodes C2 traffic with Base64.

Gootloader can retrieve a Base64 encoded stager from C2.

PingPull can encode C2 traffic with Base64.

WellMess has used Base64 encoding to uniquely identify communication to and from the C2.

Mafalda can encode data using Base64 prior to exfiltration.

Squirrelwaffle has encoded its communications to C2 servers using Base64.

HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.

RDAT can communicate with the C2 via base32-encoded subdomains.

Okrum has used base64 to encode C2 communication.

RustyWater has encoded collected data with Base64.

Fysbis can use Base64 to encode its C2 traffic.

PowerShower has the ability to encode C2 communications with base64 encoding.