Procedure examples

Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.

MuddyWater has used AES to encrypt C2 responses.

Mustang Panda has encrypted C2 communications with RC4. Mustang Panda has also leveraged encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.

ZIRCONIUM has used AES encrypted communications in C2.

Contagious Interview has encrypted C2 traffic using RC4.

Higaisa used AES-128 to encrypt C2 traffic.

RedCurl has used AES-128 CBC to encrypt C2 communications.

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.

Darkhotel has used AES-256 and 3DES for C2 communications.

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.

Inception has encrypted network communications with AES.

APT33 has used AES for encryption of command and control traffic.