Data Encoding: Standard Encoding

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.^[3]

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.^[4]

APT33 has used base64 to encode command and control traffic.^[5]

Astaroth encodes data using Base64 before sending it to the C2 server. ^[6]

AutoIt backdoor has sent a C2 response that was base64-encoded.^[7]

BabyShark has encoded data using certutil before exfiltration.^[8]

Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.^[9]

BADNEWS encodes C2 traffic with base64.^[7][10][11]

Bisonal has encoded binary data with Base64.^[12]

BLINDINGCAN has encoded its C2 traffic with Base64.^[13]

Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.^[14]

BS2005 uses Base64 encoding for communication in the message body of an HTTP request.^[15]

Carbanak encodes the message body of HTTP traffic with Base64.^[16][17]

Chaes has used Base64 to encode C2 communications.^[18]

ChChes can encode C2 data with a custom technique that utilizes Base64.^[19][20]

Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.^[21]

Cobian RAT obfuscates communications with the C2 server using Base64 encoding.^[22]

CORESHELL C2 messages are Base64-encoded.^[23]

Daserf uses custom base64 encoding to obfuscate HTTP traffic.^[14]

Denis encodes the data sent to the server in Base64.^[24]

Dipsind encodes C2 traffic with base64.^[25]

down_new has the ability to base64 encode C2 communications.^[26]

Ebury has encoded C2 traffic in hexadecimal format.^[27]

Elise exfiltrates data using cookie values that are Base64-encoded.^[28]

Some Felismus samples use a custom method for C2 traffic that utilizes Base64.^[29]

Fysbis can use Base64 to encode its C2 traffic.^[30]

gh0st RAT has used Zlib to compress C2 communications data before encrypting it.^[31]

GrimAgent can base64 encode C2 replies.^[32]

HAFNIUM has used ASCII encoding for C2 traffic.^[33]

For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.^[34]

HOPLIGHT has utilized Zlib compression to obfuscate the communications payload. ^[35]

Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.^[36][37]

A JHUHUGIT variant encodes C2 POST data base64.^[38]

Kazuar encodes communications to the C2 server in Base64.^[39]

Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.^[40]

KONNI has used a custom base64 key to encode stolen data before exfiltration.^[41]

A Lazarus Group malware sample encodes data with base64.^[42]

Machete has used base64 encoding.^[43]

MechaFlounder has the ability to use base16 encoded strings in C2.^[44]

Mis-Type uses Base64 encoding for C2 traffic.^[45]

Misdat network traffic is Base64-encoded plaintext.^[45]

More_eggs has used basE91 encoding, along with encryption, for C2 communication.^[46]

MuddyWater has used tools to encode C2 communications including Base64 encoding.^[47][48]

njRAT uses Base64 encoding for C2 traffic.^[49]

Octopus encodes C2 communications in Base64.^[50]

Okrum has used base64 to encode C2 communication.^[51]

OopsIE encodes data in hexadecimal format over the C2 channel.^[52]

Patchwork used Base64 to encode C2 traffic.^[53]

Responses from the Pisloader C2 server are base32-encoded.^[54]

PowerShower has the ability to encode C2 communications with base64 encoding.^[55][56]

POWERSTATS encoded C2 traffic with base64.^[57]

POWRUNER can use base64 encoded C2 communications.^[58]

Prikormka encodes C2 traffic with Base64.^[59]

QakBot can Base64 encode system information sent to C2.^[60][61]

QUADAGENT encodes C2 communications with base64.^[62]

Ramsay has used base64 to encode its C2 traffic.^[63]

RDAT can communicate with the C2 via base32-encoded subdomains.^[64]

Revenge RAT uses Base64 to encode information sent to the C2 server.^[65]

RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.^[66]

S-Type uses Base64 encoding for C2 traffic.^[45]

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.^[67]

SeaDuke C2 traffic is base64-encoded.^[68]

SideTwist has used Base64 for encoded C2 traffic.^[69]

Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.^[70]

SMOKEDHAM has encoded its C2 traffic with Base64.^[71]

Spark has encoded communications with the C2 server with base64.^[72]

SpeakUp encodes C&C communication using Base64. ^[73]

Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.^[74]

SUNBURST used Base64 encoding in its C2 traffic.^[75]

TA551 has used encoded ASCII text for initial C2 communications.^[76]

TrickBot can Base64-encode C2 commands.^[77]

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.^[78]

Valak has returned C2 data as encoded ASCII.^[76]

WellMess has used Base64 encoding to uniquely identify communication to and from the C2.^[79]

xCaon has used Base64 to encode its C2 traffic.^[80]

Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.^[81]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.