Procedure examples

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.

Mustang Panda stored installation payloads as encrypted files in hidden folders during RedDelta Modified PlugX Infection Chain Operations.

During RedPenguin, UNC3886 generated Base64-encoded files in the FreeBSD shell environment of targeted Juniper devices.

During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.

During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.

For Operation Spalax, the threat actors used XOR-encrypted payloads.

During the 3CX Supply Chain Attack, AppleJeus encrypts its dynamic library files (.dll) using RC4, and when loaded only decrypts specific portions of the file using the key `3jB(2bsG#@c7`.

During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure `dsls` binary.

During ShadowRay, threat actors used Base64-encrypted Python code to evade detection.

During Outer Space, OilRig deployed VBS droppers with obfuscated strings.

During the 2025 Poland Wiper Attacks, the adversaries utilized a Base64-encoded ZIP archive to prevent content analysis.

APT41 DUST used encrypted payloads decrypted and executed in memory.

During Night Dragon, threat actors used a DLL that included an XOR-encoded section.