Encrypted Channel: Asymmetric Cryptography

adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.^[1]

A variant of ADVSTORESHELL encrypts some C2 with RSA.^[2]

APT41 DUST used HTTPS for command and control.^[3]

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.^[4]

Attor's Blowfish key is encrypted with a public RSA key.^[5]

BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.^[6]

Bazar can use TLS in C2 communications.^[7]

BISCUIT uses SSL for encrypting C2 communications.^[8]

BOLDMOVE uses the WolfSSL library to implement SSL encryption for command and control communication.^[9]

During C0021, the threat actors used SSL via TCP port 443 for C2 communications.^[10]

Carbon has used RSA encryption for C2 communications.^[11]

CHOPSTICK encrypts C2 communications with TLS.^[12]

COATHANGER connects to command and control infrastructure using SSL.^[13]

Cobalt Group has used the Plink utility to create SSH tunnels.^[14]

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.^[15]

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.^[16][17]

Covenant can utilize SSL to encrypt command and control traffic.^[18]

Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.^[19]

DarkWatchman can use TLS to encrypt its C2 channel.^[20]

Doki has used the embedTLS library for network communications.^[21]

Dridex has encrypted traffic with RSA.^[22]

Empire can use TLS to encrypt its C2 channel.^[23]

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.^[24]

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.^[25]

FRP can be configured to only accept TLS connections.^[26]

Gazer uses custom encryption for C2 that uses RSA.^[27][28]

GoldMax has RSA-encrypted its communication with the C2 server.^[29]

Gomir uses reverse proxy functionality that employs SSL to encrypt communications.^[30]

Grandoreiro can use SSL in C2 communication.^[31]

GreyEnergy encrypts communications using RSA-2048.^[32]

GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.^[33]

Hi-Zor encrypts C2 traffic with TLS.^[34]

IcedID has used SSL and TLS in communications with C2.^[35][36]

During Indian Critical Infrastructure Intrusions, RedEcho used SSL for network communication.^[37]

J-magic can communicate back to send a challenge to C2 infrastructure over SSL.^[38]

KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2.^[39]

Koadic can use SSL and TLS for communications.^[40]

Kobalos's authentication and key exchange is performed using RSA-512.^[41][42]

LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.^[43]

Lumma Stealer has used HTTPS for command and control purposes.^[44]

LunarWeb can send short C2 commands, up to 512 bytes, encrypted with RSA-4096.^[45]

Machete has used TLS-encrypted FTP to exfiltrate data.^[46]

Mango can use TLS to encrypt C2 communications.^[47]

Metamorfo's C2 communication has been encrypted using OpenSSL.^[48]

Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.^[49]

Mythic supports SSL encrypted C2.^[50]

NICECURL has used HTTPS for C2 communications.^[4]

OilBooster can use the OpenSSL library to encrypt C2 communications.^[51]

OilRig used the PowerExchange utility and other tools to create tunnels to C2 servers.^[52]

During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.^[53]

Pay2Key has used RSA encrypted communications with C2.^[54]

Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.^[55]

PITSTOP has the ability to communicate over TLS.^[43]

PoetRAT used TLS to encrypt command and control (C2) communications.^[56]

POSHSPY encrypts C2 traffic with AES and RSA.^[57]

POWERSTATS has encrypted C2 traffic with RSA.^[58]

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.^[59]

RedCurl has used HTTPS for C2 communication.^[60][61]

RedEcho uses SSL for network communication.^[37]

REvil has encrypted C2 communications with the ECIES algorithm.^[62]

Rising Sun variants can use SSL for encrypting C2 communications.^[63]

Sagerunex uses HTTPS for command and control communication.^[64]

Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.^[65]

ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.^[66]

Sliver can use mutual TLS and RSA cryptography to exchange a session key.^{[67][68][69][70][71]}

Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.^[72]

SnappyTCP can use OpenSSL and TLS certificates to encrypt traffic.^[73]

SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.^[74]

SombRAT can SSL encrypt C2 traffic.^[75][76][77]

StrongPity has encrypted C2 traffic using SSL/TLS.^[78]

Sykipot uses SSL for encrypting C2 communications.^[79]

TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.^[80]

TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.^[81]

Tor encapsulates traffic in multiple layers of encryption, using TLS by default.^[82]

Trojan.Karagany can secure C2 communications with SSL and TLS.^[83]

Tropic Trooper has used SSL to connect to C2 servers.^[84][85]

Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.^[86]

Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.^[87]

Versa Director Zero Day Exploitation used HTTPS for command and control of compromised Versa Director servers.^[88]

Some Volgmer variants use SSL to encrypt C2 communications.^[89]

WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.^[90]

WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.^[91][92]

WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.^{[93][94][95][92]}

Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.^[96]

XTunnel uses SSL/TLS and RC4 to encrypt traffic.^[97][12]

Zebrocy uses SSL and AES ECB for encrypting C2 communications.^{[98][99][100]}

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.