Procedure examples

SodaMaster can use RC4 to encrypt C2 communications.

Hikit performs XOR encryption.

Sakula encodes C2 traffic with single-byte XOR keys.

Bazar can send C2 communications with XOR encryption.

Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.

BADCALL encrypts C2 traffic using an XOR/ADD cipher.

MoonWind encrypts C2 traffic using RC4 with a static key.

HiddenFace can use a randomly selected symmetric encryption algorithm for C2.

Pandora has the ability to encrypt communications with D3DES.

Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.

SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.

Samurai can encrypt C2 communications with AES.

OSX_OCEANLOTUS.D encrypts data sent back to the C2 using AES in CBC mode with a null initialization vector (IV) and a key sent from the server that is padded to 32 bytes.

Taidoor uses RC4 to encrypt the message body of HTTP content.

PoisonIvy uses the Camellia cipher to encrypt communications.

NanoCore uses DES to encrypt the C2 traffic.

PLEAD has used RC4 encryption to download modules.

Daserf uses RC4 encryption to obfuscate HTTP traffic.

Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.

Solar can XOR encrypt C2 communications.

The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.

More_eggs has used an RC4-based encryption method for its C2 communications.

SysUpdate has used DES to encrypt all C2 communications.

Mango can receive XOR-encrypted commands from C2.

WIREFIRE can AES encrypt process output sent from compromised devices to C2.

GrimAgent can use an AES key to encrypt C2 communications.

LookBack uses a modified version of RC4 for data transfer.

CallMe uses AES to encrypt C2 traffic.

CHOPSTICK encrypts C2 communications with RC4.

RIFLESPINE can use the AES algorithm to encrypt C2 data.

SLIGHTPULSE can RC4 encrypt all incoming and outgoing C2 messages.

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.

Winnti for Windows can XOR encrypt C2 traffic.

Troll Stealer encrypts data sent to command and control infrastructure using a combination of RC4 and RSA-4096 algorithms.

Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.

ZIPLINE can use AES-128-CBC to encrypt data for both upload and download.

ChChes can encrypt C2 traffic with AES or RC4.

The IceApple Result Retriever module can AES encrypt C2 responses.

metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.

SideTwist can encrypt C2 communications with a randomly generated key.

LunarWeb can send AES encrypted C2 commands.

XCSSET uses RC4 encryption over TCP to communicate with its C2 server.

Dipsind encrypts C2 data with AES256 in ECB mode.

httpclient encrypts C2 content with XOR using a single byte, 0x12.

POWERTON has used AES for encrypting C2 traffic.

StarProxy has leveraged two 256-byte XOR keys to encrypt and decrypt network packets using a custom algorithm.

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.

QakBot can RC4 encrypt strings in C2 communication.