Procedure examples

FALLCHILL encrypts C2 data with RC4 encryption.

Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.

FRP can use STCP (Secret TCP) with a preshared key to encrypt services exposed to public networks.

QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.

TeamPCP Cloud Stealer has encrypted collected data using a hybrid AES-256 and RSA-4096 encryption prior to exfiltration over 'curl`.

The Duqu command and control protocol's data stream can be encrypted with AES-CBC.

During Indian Critical Infrastructure Intrusions, RedEcho used SSL for network communication.

During C0021, the threat actors used SSL via TCP port 443 for C2 communications.

APT41 DUST used HTTPS for command and control.

Versa Director Zero Day Exploitation used HTTPS for command and control of compromised Versa Director servers.

During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.

RedEcho uses SSL for network communication.

TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.

OilRig used the PowerExchange utility and other tools to create tunnels to C2 servers.

Tropic Trooper has used SSL to connect to C2 servers.

RedCurl has used HTTPS for C2 communication.

Medusa Group has used HTTPS for command and control.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

Cobalt Group has used the Plink utility to create SSH tunnels.

Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.

BRICKSTORM has communicated with C2 infrastructure via TLS.

NICECURL has used HTTPS for C2 communications.

COATHANGER connects to command and control infrastructure using SSL.

Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.

adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.

CASTLETAP can initiate a C2 connection over an SSL socket.

LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.

StrongPity has encrypted C2 traffic using SSL/TLS.

TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.

J-magic can communicate back to send a challenge to C2 infrastructure over SSL.

GreyEnergy encrypts communications using RSA-2048.

Gomir uses reverse proxy functionality that employs SSL to encrypt communications.

BOLDMOVE uses the WolfSSL library to implement SSL encryption for command and control communication.

BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.

Machete has used TLS-encrypted FTP to exfiltrate data.

WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.

Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.

SombRAT can SSL encrypt C2 traffic.

Some Volgmer variants use SSL to encrypt C2 communications.

Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.

REPTILE can use TLS over raw TCP for secure C2.

Doki has used the embedTLS library for network communications.

IcedID has used SSL and TLS in communications with C2.

Rising Sun variants can use SSL for encrypting C2 communications.

Hi-Zor encrypts C2 traffic with TLS.

SnappyTCP can use OpenSSL and TLS certificates to encrypt traffic.

GoldMax has RSA-encrypted its communication with the C2 server.

POSHSPY encrypts C2 traffic with AES and RSA.