Procedure examples

HiddenFace can use RSA-2048 in addition to symmetric algorithms in C2.

Zebrocy uses SSL and AES ECB for encrypting C2 communications.

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.

ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.

REvil has encrypted C2 communications with the ECIES algorithm.

OilBooster can use the OpenSSL library to encrypt C2 communications.

Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.

Carbon has used RSA encryption for C2 communications.

BISCUIT uses SSL for encrypting C2 communications.

LAMEHUG can use SSH to transfer information to C2.

Mango can use TLS to encrypt C2 communications.

GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.

PoetRAT used TLS to encrypt command and control (C2) communications.

CHOPSTICK encrypts C2 communications with TLS.

Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.

PITSTOP has the ability to communicate over TLS.

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.

LunarWeb can send short C2 commands, up to 512 bytes, encrypted with RSA-4096.

POWERSTATS has encrypted C2 traffic with RSA.

Dridex has encrypted traffic with RSA.

A variant of ADVSTORESHELL encrypts some C2 with RSA.

Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.

Covenant can utilize SSL to encrypt command and control traffic.

Sliver can use mutual TLS and RSA cryptography to exchange a session key.

DCRAT can use certificate-based authentication for C2 servers.

Empire can use TLS to encrypt its C2 channel.

FRP can be configured to only accept TLS connections.

Remcos can use TLS to encrypt C2 communication.

Koadic can use SSL and TLS for communications.

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.

Mythic supports SSL encrypted C2.

Tor encapsulates traffic in multiple layers of encryption, using TLS by default.

TeamPCP Cloud Stealer has encrypted collected data using a hybrid RSA-4096 and AES-256-encryption prior to exfiltration over 'curl`.

COATHANGER will remove and write malicious shared objects associated with legitimate system functions such as `read(2)`.

Raspberry Robin will drop a copy of itself to a subfolder in %Program Data% or %Program Data%\\Microsoft\\ to attempt privilege elevation and defense evasion if not running in Session 0.

Nightdoor uses a legitimate executable to load a malicious DLL file for installation.

ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.

DarkGate edits the Registry key HKCU\Software\Classes\mscfile\shell\open\command to execute a malicious AutoIt script. When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.

Saint Bot will use the malicious file slideshow.mp4 if present to load the core API provided by ntdll.dll to avoid any hooks placed on calls to the original ntdll.dll file by endpoint detection and response or antimalware software.

SPAWNCHIMERA can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.

Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.

One of Dtrack can replace the normal flow of a program execution with malicious code.

Ninja loaders can be side-loaded with legitimate and signed executables including the VLC.exe media player.

RCSession can be installed via DLL side-loading.

IronWind has used DLL sideloading for execution.

Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.

Chinoxy can use a digitally signed binary ("Logitech Bluetooth Wizard Host Process") to load its dll into memory.

PAKLOG has leveraged legitimate binaries to conduct DLL side-loading.

RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.

Havoc has leveraged legitimate executables to side-load malicious payloads.