Thanks to all of our ATT&CKcon participants. All sessions are here, and individual presentations will be posted soon.

Standard Cryptographic Protocol

Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.

ID: T1032

Tactic: Command And Control

Platform:  Linux, macOS, Windows

Data Sources:  Packet capture, Netflow/Enclave netflow, Malware reverse engineering, Process use of network, Process monitoring, SSL/TLS inspection

Requires Network:  Yes

Version: 1.0

Examples

NameDescription
3PARA RAT

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS.[1]

adbupd

adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.[2]

ADVSTORESHELL

A variant of ADVSTORESHELL encrypts some C2 with 3DES and RSA.[3]

Bisonal

Some Bisonal samples encrypt C2 communications with RC4.[4]

BRONZE BUTLER

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic.[5]

CallMe

CallMe uses AES to encrypt C2 traffic.[6]

Carbanak

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode) and Base64 encoding.[7][8]

Chaos

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.[9]

ChChes

ChChes can encrypt C2 traffic with AES.[10][11]

CHOPSTICK

CHOPSTICK encrypts C2 communications with RC4 as well as TLS.[12]

Cobalt Group

Cobalt Group has used the Plink utility to create SSH tunnels.[13]

Comnie

Comnie encrypts command and control communications with RC4.[14]

Daserf

Daserf uses RC4 encryption to obfuscate HTTP traffic.[5]

Dipsind

Dipsind encrypts C2 data with AES256 in ECB mode.[2]

Downdelph

Downdelph uses RC4 to encrypt C2 responses.[15]

Duqu

The Duqu command and control protocol's data stream can be encrypted with AES-CBC.[16]

Elise

Elise encrypts exfiltrated data with RC4.[17]

FakeM

Some variants of FakeM use RC4 to encrypt C2 traffic.[6]

Felismus

Some Felismus samples use AES to encrypt C2 traffic.[18]

FIN6

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.[19]

FIN8

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.[20]

H1N1

H1N1 encrypts C2 traffic using an RC4 key.[21]

Helminth

Helminth encrypts data sent to its C2 server over HTTP with RC4.[22]

Koadic

Koadic can use SSL and TLS for communications.[23]

Lazarus Group

Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.[24]

MobileOrder

MobileOrder uses AES to encrypt C2 communications.[6]

MoonWind

MoonWind encrypts C2 traffic using RC4 with a static key.[25]

NDiskMonitor

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.[26]

NETEAGLE

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."[27]

Nidiran

Nidiran uses RC4 to encrypt C2 traffic.[28]

OilRig

OilRig used the Plink utility and other tools to create tunnels to C2 servers.[29]

PoisonIvy

PoisonIvy uses the Camellia cipher to encrypt communications.[30]

POSHSPY

POSHSPY encrypts C2 traffic with AES and RSA.[31]

POWERSTATS

POWERSTATS has encrypted C2 traffic with RSA.[32]

Prikormka

Prikormka encrypts some C2 traffic with the Blowfish cipher.[33]

Pupy

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.[34]

QuasarRAT

QuasarRAT uses AES to encrypt network communication.[35][36]

RedLeaves

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.[37]

Remsec

Remsec's network loader encrypts C2 traffic with RSA and RC6.[38]

RIPTIDE

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.[39]

SeaDuke

SeaDuke C2 traffic has been encrypted with RC4 and AES.[40][41]

SNUGRIDE

SNUGRIDE encrypts C2 traffic using AES with a static key.[42]

Stealth Falcon

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.[43]

Taidoor

Taidoor uses RC4 to encrypt the message body of HTTP content.[44]

UPPERCUT

Some versions of UPPERCUT have used the hard-coded string "this is the encrypt key" for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.[45]

Volgmer

Some Volgmer variants use SSL to encrypt C2 communications.[46]

XTunnel

XTunnel uses SSL/TLS and RC4 to encrypt traffic.[47][12]

ZeroT

ZeroT has used RC4 to encrypt C2 traffic.[48][49]

Mitigation

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Use of encryption protocols may make typical network-based C2 detection more difficult due to a reduced ability to signature the traffic. Prior knowledge of adversary C2 infrastructure may be useful for domain and IP address blocking, but will likely not be an effective long-term solution because adversaries can change infrastructure often. [50]

Detection

SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels. [51] SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation. [52]

If malware uses encryption with symmetric keys, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures. [53]

In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. [50]

References

  1. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  2. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  3. Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.
  4. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  5. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  6. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  7. Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.
  8. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  9. Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.
  10. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  11. Nakamura, Y.. (2017, February 17). ChChes - Malware that Communicates with C&C Servers Using Cookie Headers. Retrieved March 1, 2017.
  12. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  13. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  14. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  15. ESET. (2016, October). En Route with Sednit - Part 3: A Mysterious Downloader. Retrieved November 21, 2016.
  16. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  17. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  18. Somerville, L. and Toro, A. (2017, March 30). Playing Cat & Mouse: Introducing the Felismus Malware. Retrieved November 16, 2017.
  19. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016.
  20. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  21. Reynolds, J.. (2016, September 14). H1N1: Technical analysis reveals new capabilities – part 2. Retrieved September 26, 2016.
  22. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  23. Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018.
  24. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  25. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  26. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  27. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  1. DiMaggio, J.. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.
  2. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.
  3. FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved November 12, 2014.
  4. Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.
  5. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  6. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
  7. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  8. MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.
  9. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  10. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  11. Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.
  12. Moran, N., Oppenheim, M., Engle, S., & Wartell, R.. (2014, September 3). Darwin’s Favorite APT Group [Blog]. Retrieved November 12, 2014.
  13. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved October 4, 2016.
  14. Grunzweig, J.. (2015, July 14). Unit 42 Technical Analysis: Seaduke. Retrieved August 3, 2016.
  15. FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.
  16. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  17. Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014.
  18. Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
  19. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.
  20. Belcher, P.. (2016, July 28). Tunnel of Gov: DNC Hack and the Russian XTunnel. Retrieved August 3, 2016.
  21. Axel F. (2017, April 27). APT Targets Financial Analysts with CVE-2017-0199. Retrieved February 15, 2018.
  22. Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.
  23. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
  24. Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.
  25. Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.
  26. Fidelis Cybersecurity. (2015, August 4). Looking at the Sky for a DarkComet. Retrieved April 5, 2016.