Procedure examples

TrickBot can Base64-encode C2 commands.

BLINDINGCAN has encoded its C2 traffic with Base64.

Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.

Spark has encoded communications with the C2 server with base64.

Bumblebee has the ability to base64 encode C2 server responses.

BRICKSTORM has leveraged Base64 to encode C2 communications.

Torisma has encoded C2 communications with Base64.

Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.

Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.

RotaJakiro uses ZLIB Compression to compresses data sent to the C2 server in the `payload` section network communication packet.

POWRUNER can use base64 encoded C2 communications.

Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.

Misdat network traffic is Base64-encoded plaintext.

TAMECAT has encoded C2 traffic with Base64.

Some Felismus samples use a custom method for C2 traffic that utilizes Base64.

xCaon has used Base64 to encode its C2 traffic.

Gomir uses Base64-encoded content in HTTP communications to command and control infrastructure.

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server. Additionally, Emotet has used Base64 to encode data before sending to the C2 server.

Machete has used base64 encoding.

Prikormka encodes C2 traffic with Base64.

Gootloader can retrieve a Base64 encoded stager from C2.

PingPull can encode C2 traffic with Base64.

WellMess has used Base64 encoding to uniquely identify communication to and from the C2.

Mafalda can encode data using Base64 prior to exfiltration.

Squirrelwaffle has encoded its communications to C2 servers using Base64.

HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.

RDAT can communicate with the C2 via base32-encoded subdomains.

Okrum has used base64 to encode C2 communication.

RustyWater has encoded collected data with Base64.

Fysbis can use Base64 to encode its C2 traffic.

PowerShower has the ability to encode C2 communications with base64 encoding.

Kazuar encodes communications to the C2 server in Base64.

GLASSTOKEN has hexadecimal and Base64 encoded C2 content.

Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.

CORESHELL C2 messages are Base64-encoded.

DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.

Bisonal has encoded binary data with Base64 and ASCII.

S-Type uses Base64 encoding for C2 traffic.

SeaDuke C2 traffic is base64-encoded.

BS2005 uses Base64 encoding for communication in the message body of an HTTP request.

Mongall can use Base64 to encode information sent to its C2.

LockBit 3.0 can Base64-encode C2 communication.

Carbanak encodes the message body of HTTP traffic with Base64.

Elise exfiltrates data using cookie values that are Base64-encoded.

Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.

Saint Bot has used Base64 to encode its C2 communications.

Chaes has used Base64 to encode C2 communications.

CharmPower can send additional modules over C2 encoded with base64.

SMOKEDHAM has encoded its C2 traffic with Base64.

Mori can use Base64 encoded JSON libraries used in C2.