Procedure examples

BRICKSTORM has communicated with C2 infrastructure via TLS.

NICECURL has used HTTPS for C2 communications.

COATHANGER connects to command and control infrastructure using SSL.

Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.

adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.

CASTLETAP can initiate a C2 connection over an SSL socket.

LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.

StrongPity has encrypted C2 traffic using SSL/TLS.

TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.

J-magic can communicate back to send a challenge to C2 infrastructure over SSL.

GreyEnergy encrypts communications using RSA-2048.

Gomir uses reverse proxy functionality that employs SSL to encrypt communications.

BOLDMOVE uses the WolfSSL library to implement SSL encryption for command and control communication.

BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.

Machete has used TLS-encrypted FTP to exfiltrate data.

WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.

Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.

SombRAT can SSL encrypt C2 traffic.

Some Volgmer variants use SSL to encrypt C2 communications.

Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.

REPTILE can use TLS over raw TCP for secure C2.

Doki has used the embedTLS library for network communications.

IcedID has used SSL and TLS in communications with C2.

Rising Sun variants can use SSL for encrypting C2 communications.

Hi-Zor encrypts C2 traffic with TLS.

SnappyTCP can use OpenSSL and TLS certificates to encrypt traffic.

GoldMax has RSA-encrypted its communication with the C2 server.

POSHSPY encrypts C2 traffic with AES and RSA.

DarkWatchman can use TLS to encrypt its C2 channel.

Lumma Stealer has used HTTPS for command and control purposes.

Sykipot uses SSL for encrypting C2 communications.

KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2.

PureCrypter can send a TLS 1.2 encrypted infection message via Discord webhook.

XTunnel uses SSL/TLS and RC4 to encrypt traffic.

WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.

Gazer uses custom encryption for C2 that uses RSA.

Pay2Key has used RSA encrypted communications with C2.

Sagerunex uses HTTPS for command and control communication.

Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.

Metamorfo's C2 communication has been encrypted using OpenSSL.

Trojan.Karagany can secure C2 communications with SSL and TLS.

Attor's Blowfish key is encrypted with a public RSA key.

SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.

Grandoreiro can use SSL in C2 communication.

WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.

Bazar can use TLS in C2 communications.

Kobalos's authentication and key exchange is performed using RSA-512.

HiddenFace can use RSA-2048 in addition to symmetric algorithms in C2.

Zebrocy uses SSL and AES ECB for encrypting C2 communications.

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.