Encrypted Channel: Symmetric Cryptography

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails^[1]

4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.^[1]

A variant of ADVSTORESHELL encrypts some C2 with 3DES.^[2]

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.^[3]

APT33 has used AES for encryption of command and control traffic.^[4]

Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.^[5]

Azorult can encrypt C2 traffic using XOR.^[6][7]

BADCALL encrypts C2 traffic using an XOR/ADD cipher.^[8]

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.^[9][10]

Bandook has used AES encryption for C2 communication.^[11]

Bazar can send C2 communications with XOR encryption.^[12]

BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.^[13]

BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.^[14]

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.^[15][16][17]

BLINDINGCAN has encrypted its C2 traffic with RC4.^[18]

Bonadan can XOR-encrypt C2 communications.^[19]

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.^[20]

Bumblebee can encrypt C2 requests and responses with RC4^[21]

CallMe uses AES to encrypt C2 traffic.^[22]

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.^[23][24]

Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.^[25]

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.^[26]

CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.^[27]

ChChes can encrypt C2 traffic with AES or RC4.^[28][29]

CHOPSTICK encrypts C2 communications with RC4.^[30]

Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.^[31]

Comnie encrypts command and control communications with RC4.^[32]

CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.^[33]

CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.^[34]

Darkhotel has used AES-256 and 3DES for C2 communications.^[35]

Daserf uses RC4 encryption to obfuscate HTTP traffic.^[20]

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.^[36]

Dipsind encrypts C2 data with AES256 in ECB mode.^[37]

down_new has the ability to AES encrypt C2 communications.^[38]

Downdelph uses RC4 to encrypt C2 responses.^[39]

Dridex has encrypted traffic with RC4.^[40]

The Duqu command and control protocol's data stream can be encrypted with AES-CBC.^[41]

Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.^[42]

Elise encrypts exfiltrated data with RC4.^[43]

The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.^[44]

Emotet is known to use RSA keys for encrypting C2 traffic. ^[45]

Epic encrypts commands from the C2 server using a hardcoded key.^[46]

Explosive has encrypted communications with the RC4 method.^[47]

The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of "YHCRA" and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.^[22]

FALLCHILL encrypts C2 data with RC4 encryption.^[48][49]

FatDuke can AES encrypt C2 communications.^[50]

Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.^[51]

FlawedAmmyy has used SEAL encryption during the initial C2 handshake.^[52]

FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.^[53]

During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.^[54]

FRP can use STCP (Secret TCP) with a preshared key to encrypt services exposed to public networks.^[55]

Gazer uses custom encryption for C2 that uses 3DES.^[56][57]

gh0st RAT uses RC4 and XOR to encrypt C2 traffic.^[58]

GreyEnergy encrypts communications using AES256.^[59]

GrimAgent can use an AES key to encrypt C2 communications.^[60]

H1N1 encrypts C2 traffic using an RC4 key.^[61]

Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.^[62]

Helminth encrypts data sent to its C2 server over HTTP with RC4.^[63]

Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.^[64]

HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.^[65]

Higaisa used AES-128 to encrypt C2 traffic.^[66]

Hikit performs XOR encryption.^[67]

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.^[68][69]

httpclient encrypts C2 content with XOR using a single byte, 0x12.^[1]

Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.^[70]

HyperStack has used RSA encryption for C2 communications.^[71]

The IceApple Result Retriever module can AES encrypt C2 responses.^[72]

Inception has encrypted network communications with AES.^[73]

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.^[74]

KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.^[75]

Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.^[76][77]

The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.^[78]

KONNI has used AES to encrypt C2 traffic.^[79]

Latrodectus can send RC4 encrypted data over C2 channels.^[80][81][82]

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.^{[83][84][85][86]}

LightNeuron uses AES to encrypt C2 traffic.^[87]

LIGHTWIRE can RC4 encrypt C2 commands.^[88]

LookBack uses a modified version of RC4 for data transfer.^[89]

Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.^[90]

LunarWeb can send AES encrypted C2 commands.^[91]

Lurid performs XOR encryption.^[92]

Machete has used AES to exfiltrate documents.^[93]

Mafalda can encrypt its C2 traffic with RC4.^[94]

metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.^[94][95]

Metamorfo has encrypted C2 commands with AES-256.^[96]

Mongall has the ability to RC4 encrypt C2 communications.^[97]

MoonWind encrypts C2 traffic using RC4 with a static key.^[98]

More_eggs has used an RC4-based encryption method for its C2 communications.^[99]

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.^[100]

MuddyWater has used AES to encrypt C2 responses.^[101]

Mustang Panda has encrypted C2 communications with RC4.^[102]

NanoCore uses DES to encrypt the C2 traffic.^[103]

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.^[10]

Nebulae can use RC4 and XOR to encrypt C2 communications.^[104]

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."^[105]

NETWIRE can use AES encryption for C2 data transferred.^[106]

NGLite will use an AES encrypted channel for command and control purposes, in one case using the key WHATswrongwithUu.^[107]

Ninja can XOR and AES encrypt C2 messages.^[108]

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. ^[109]

During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.^[110]

OSX_OCEANLOTUS.D encrypts data sent back to the C2 using AES in CBC mode with a null initialization vector (IV) and a key sent from the server that is padded to 32 bytes.^[111]

Pandora has the ability to encrypt communications with D3DES.^[112]

Earlier Pikabot variants use a custom encryption procedure leveraging multiple mechanisms including AES with multiple rounds of Base64 encoding for its command and control communication.^[113] Later Pikabot variants eliminate the use of AES and instead use RC4 encryption for transmitted information.^[114]

PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.^[115]

PipeMon communications are RC4 encrypted.^[116]

PLAINTEE encodes C2 beacons using XOR.^[117]

PLEAD has used RC4 encryption to download modules.^[118]

PlugX can use RC4 encryption in C2 communications.^[119]

PoisonIvy uses the Camellia cipher to encrypt communications.^[120]

POWERTON has used AES for encrypting C2 traffic.^[4]

Prikormka encrypts some C2 traffic with the Blowfish cipher.^[121]

QakBot can RC4 encrypt strings in C2 communication.^[122]

QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.^{[123][124][125]}

QUIETCANARY can RC4 encrypt C2 communications.^[126]

RainyDay can use RC4 to encrypt C2 communications.^[104]

RDAT has used AES ciphertext to encode C2 communications.^[127]

RedCurl has used AES-128 CBC to encrypt C2 communications.^[128]

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.^[129]

Rifdoor has encrypted command and control (C2) communications with a stream cipher.^[68]

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.^[130]

RotaJakiro encrypts C2 communication using a combination of AES, XOR, ROTATE encryption, and ZLIB compression.^[131]

RTM encrypts C2 traffic with a custom RC4 variant.^[132]

Sakula encodes C2 traffic with single-byte XOR keys.^[133]

Samurai can encrypt C2 communications with AES.^[108]

Sardonic has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 servers.^[134]

SeaDuke C2 traffic has been encrypted with RC4 and AES.^[135][136]

SideTwist can encrypt C2 communications with a randomly generated key.^[137]

SLIGHTPULSE can RC4 encrypt all incoming and outgoing C2 messages.^[138]

Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.^[139]

SMOKEDHAM has encrypted its C2 traffic with RC4.^[140]

SNUGRIDE encrypts C2 traffic using AES with a static key.^[141]

SodaMaster can use RC4 to encrypt C2 communications.^[142]

SombRAT has encrypted its C2 communications with AES.^[143]

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.^[144]

StrifeWater can encrypt C2 traffic using XOR with a hard coded key.^[145]

Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.^[146]

SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.^[147]

Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.^[148]

SysUpdate has used DES to encrypt all C2 communications.^[149]

Taidoor uses RC4 to encrypt the message body of HTTP content.^[150][151]

TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.^[152]

Torisma has encrypted its C2 communications using XOR and VEST-32.^[153]

TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.^[154]Newer versions of TrickBot have been known to use bcrypt to encrypt and digitally sign responses to their C2 server. ^[155]

TSCookie has encrypted network communications with RC4.^[156]

UBoatRAT encrypts instructions in its C2 network payloads using a simple XOR cipher.^[157]

Some versions of UPPERCUT have used the hard-coded string "this is the encrypt key" for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.^[158]

Uroburos can encrypt the data beneath its http2 or tcp encryption at the session layer with CAST-128, using a different key for incoming and outgoing data.^[159]

Volgmer uses a simple XOR cipher to encrypt traffic and files.^[160]

Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.^[161]

WarzoneRAT can encrypt its C2 with RC4 with the password warzone160\x00.^[162]

WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.^{[163][164][165]}

Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).^[166]

Winnti for Windows can XOR encrypt C2 traffic.^[167]

WIREFIRE can AES encrypt process output sent from compromised devices to C2.^[168]

Woody RAT can use AES-CBC to encrypt data sent to its C2 server.^[169]

xCaon has encrypted data sent to the C2 server using a XOR key.^[170]

XCSSET uses RC4 encryption over TCP to communicate with its C2 server.^[171]

ZeroT has used RC4 to encrypt C2 traffic.^[172][173]

ZIPLINE can use AES-128-CBC to encrypt data for both upload and download.^[88]

ZIRCONIUM has used AES encrypted communications in C2.^[174]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.