T1573.002
Encrypted Channel: Asymmetric Cryptography

adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.^[1]

A variant of ADVSTORESHELL encrypts some C2 with RSA.^[2]

Attor's Blowfish key is encrypted with a public RSA key.^[3]

Bazar can use TLS in C2 communications.^[4]

BISCUIT uses SSL for encrypting C2 communications.^[5]

Carbon has used RSA encryption for C2 communications.^[6]

CHOPSTICK encrypts C2 communications with TLS.^[7]

Cobalt Group has used the Plink utility to create SSH tunnels.^[8]

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.^[9]

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.^[10][11]

Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.^[12]

DarkWatchman can use TLS to encrypt its C2 channel.^[13]

Doki has used the embedTLS library for network communications.^[14]

Dridex has encrypted traffic with RSA.^[15]

Emotet is known to use RSA keys for encrypting C2 traffic. ^[16]

Empire can use TLS to encrypt its C2 channel.^[17]

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.^[18]

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.^[19]

Gazer uses custom encryption for C2 that uses RSA.^[20][21]

GoldMax has RSA-encrypted its communication with the C2 server.^[22]

Grandoreiro can use SSL in C2 communication.^[23]

GreyEnergy encrypts communications using RSA-2048.^[24]

GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.^[25]

Hi-Zor encrypts C2 traffic with TLS.^[26]

IcedID has used SSL and TLS in communications with C2.^[27][28]

Koadic can use SSL and TLS for communications.^[29]

Kobalos's authentication and key exchange is performed using RSA-512.^[30][31]

Machete has used TLS-encrypted FTP to exfiltrate data.^[32]

Metamorfo's C2 communication has been encrypted using OpenSSL.^[33]

Mythic supports SSL encrypted C2.^[34]

OilRig used the Plink utility and other tools to create tunnels to C2 servers.^[35]

During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.^[36]

Pay2Key has used RSA encrypted communications with C2.^[37]

Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.^[38]

PoetRAT used TLS to encrypt command and control (C2) communications.^[39]

POSHSPY encrypts C2 traffic with AES and RSA.^[40]

POWERSTATS has encrypted C2 traffic with RSA.^[41]

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.^[42]

REvil has encrypted C2 communications with the ECIES algorithm.^[43]

Rising Sun variants can use SSL for encrypting C2 communications.^[44]

ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.^[45]

Sliver can use mutual TLS and RSA cryptography to exchange a session key.^[46][47][48]

Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.^[49]

SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.^[50]

SombRAT can SSL encrypt C2 traffic.^[51][52][53]

StrongPity has encrypted C2 traffic using SSL/TLS.^[54]

Sykipot uses SSL for encrypting C2 communications.^[55]

TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.^[56]

Tor encapsulates traffic in multiple layers of encryption, using TLS by default.^[57]

Trojan.Karagany can secure C2 communications with SSL and TLS.^[58]

Tropic Trooper has used SSL to connect to C2 servers.^[59][60]

Some Volgmer variants use SSL to encrypt C2 communications.^[61]

WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.^[62]

WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.^[63][64]

WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.^{[65][66][67][64]}

XTunnel uses SSL/TLS and RC4 to encrypt traffic.^[68][7]

Zebrocy uses SSL and AES ECB for encrypting C2 communications.^[69][70][71]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.