Procedure examples

Epic encrypts commands from the C2 server using a hardcoded key.

LightNeuron uses AES to encrypt C2 traffic.

PureCrypter can use AES to encrypt system information sent to the C2.

Mongall has the ability to RC4 encrypt C2 communications.

LockBit 3.0 can encrypt C2 communications with AES.

FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.

NGLite will use an AES encrypted channel for command and control purposes, in one case using the key WHATswrongwithUu.

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.

Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.

Elise encrypts exfiltrated data with RC4.

Gazer uses custom encryption for C2 that uses 3DES.

TSCookie has encrypted network communications with RC4.

Latrodectus can send RC4 encrypted data over C2 channels.

LODEINFO can encrypt C2 communication with a hardcoded (NV4HDOeOVyL) Vigenere cipher key.

CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.

MuddyViper has the ability to encrypt C2 communication using AES-CBC using the CNG API, the key `0608101047106453101617106423101013101012101083109710108585106969`, and the initialization vector `0`.

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails

VIRTUALPIE can use a custom RC4 encrypted protocol for C2 communications.

SMOKEDHAM has encrypted its C2 traffic with RC4.

TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.

Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.

BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.

Uroburos can encrypt the data beneath its http2 or tcp encryption at the session layer with CAST-128, using a different key for incoming and outgoing data.

Metamorfo has encrypted C2 commands with AES-256.

Bandook has used AES encryption for C2 communication.

PipeMon communications are RC4 encrypted.

KONNI has used AES to encrypt C2 traffic.

Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).

gh0st RAT uses RC4 and XOR to encrypt C2 traffic.

down_new has the ability to AES encrypt C2 communications.

4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.

Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.

RTM encrypts C2 traffic with a custom RC4 variant.

QUIETCANARY can RC4 encrypt C2 communications.

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.

SodaMaster can use RC4 to encrypt C2 communications.

Hikit performs XOR encryption.

Sakula encodes C2 traffic with single-byte XOR keys.

Bazar can send C2 communications with XOR encryption.

Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.

BADCALL encrypts C2 traffic using an XOR/ADD cipher.

MoonWind encrypts C2 traffic using RC4 with a static key.

HiddenFace can use a randomly selected symmetric encryption algorithm for C2.

Pandora has the ability to encrypt communications with D3DES.

Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.

SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.

Samurai can encrypt C2 communications with AES.