Procedure examples

DarkWatchman can use TLS to encrypt its C2 channel.

Lumma Stealer has used HTTPS for command and control purposes.

Sykipot uses SSL for encrypting C2 communications.

KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2.

PureCrypter can send a TLS 1.2 encrypted infection message via Discord webhook.

XTunnel uses SSL/TLS and RC4 to encrypt traffic.

WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.

Gazer uses custom encryption for C2 that uses RSA.

Pay2Key has used RSA encrypted communications with C2.

Sagerunex uses HTTPS for command and control communication.

Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.

Metamorfo's C2 communication has been encrypted using OpenSSL.

Trojan.Karagany can secure C2 communications with SSL and TLS.

Attor's Blowfish key is encrypted with a public RSA key.

SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.

Grandoreiro can use SSL in C2 communication.

WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.

Bazar can use TLS in C2 communications.

Kobalos's authentication and key exchange is performed using RSA-512.

HiddenFace can use RSA-2048 in addition to symmetric algorithms in C2.

Zebrocy uses SSL and AES ECB for encrypting C2 communications.

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.

ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.

REvil has encrypted C2 communications with the ECIES algorithm.

OilBooster can use the OpenSSL library to encrypt C2 communications.

Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.

Carbon has used RSA encryption for C2 communications.

BISCUIT uses SSL for encrypting C2 communications.

LAMEHUG can use SSH to transfer information to C2.

Mango can use TLS to encrypt C2 communications.

GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.

PoetRAT used TLS to encrypt command and control (C2) communications.

CHOPSTICK encrypts C2 communications with TLS.

Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.

PITSTOP has the ability to communicate over TLS.

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.

LunarWeb can send short C2 commands, up to 512 bytes, encrypted with RSA-4096.

POWERSTATS has encrypted C2 traffic with RSA.

Dridex has encrypted traffic with RSA.

A variant of ADVSTORESHELL encrypts some C2 with RSA.

Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.

Covenant can utilize SSL to encrypt command and control traffic.

Sliver can use mutual TLS and RSA cryptography to exchange a session key.

DCRAT can use certificate-based authentication for C2 servers.

Empire can use TLS to encrypt its C2 channel.

FRP can be configured to only accept TLS connections.

Remcos can use TLS to encrypt C2 communication.

Koadic can use SSL and TLS for communications.

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.

Mythic supports SSL encrypted C2.