Encrypted Channel: Asymmetric Cryptography

adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.^[1]

A variant of ADVSTORESHELL encrypts some C2 with RSA.^[2]

Attor's Blowfish key is encrypted with a public RSA key.^[3]

Bazar can use TLS in C2 communications.^[4]

BISCUIT uses SSL for encrypting C2 communications.^[5]

Carbon has used RSA encryption for C2 communications.^[6]

CHOPSTICK encrypts C2 communications with TLS.^[7]

Cobalt Group has used the Plink utility to create SSH tunnels.^[8]

Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.^[9]

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.^[10][11]

Doki has used the embedTLS library for network communications.^[12]

Dridex has encrypted traffic with RSA.^[13]

Emotet is known to use RSA keys for encrypting C2 traffic. ^[14]

Empire can use TLS to encrypt its C2 channel.^[15]

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.^[16]

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.^[17]

Gazer uses custom encryption for C2 that uses RSA.^[18][19]

GoldMax has RSA-encrypted its communication with the C2 server.^[20]

Grandoreiro can use SSL in C2 communication.^[21]

GreyEnergy encrypts communications using RSA-2048.^[22]

GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.^[23]

Hi-Zor encrypts C2 traffic with TLS.^[24]

IcedID has used SSL and TLS in communications with C2.^[25][26]

Koadic can use SSL and TLS for communications.^[27]

Kobalos's authentication and key exchange is performed using RSA-512.^[28][29]

Machete has used TLS-encrypted FTP to exfiltrate data.^[30]

Metamorfo's C2 communication has been encrypted using OpenSSL.^[31]

OilRig used the Plink utility and other tools to create tunnels to C2 servers.^[32]

Operation Wocao's proxy implementation "Agent" can upgrade the socket in use to a TLS socket.^[33]

Pay2Key has used RSA encrypted communications with C2.^[34]

Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.^[35]

PoetRAT used TLS to encrypt command and control (C2) communications.^[36]

POSHSPY encrypts C2 traffic with AES and RSA.^[37]

POWERSTATS has encrypted C2 traffic with RSA.^[38]

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.^[39]

REvil has encrypted C2 communications with the ECIES algorithm.^[40]

ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.^[41]

Sliver can use mutual TLS and RSA cryptography to exchange a session key.^[42][43][44]

SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.^[45]

SombRAT can SSL encrypt C2 traffic.^[46][47][48]

StrongPity has encrypted C2 traffic using SSL/TLS.^[49]

Sykipot uses SSL for encrypting C2 communications.^[50]

Tor encapsulates traffic in multiple layers of encryption, using TLS by default.^[51]

Trojan.Karagany can secure C2 communications with SSL and TLS.^[52]

Tropic Trooper has used SSL to connect to C2 servers.^[53][54]

Some Volgmer variants use SSL to encrypt C2 communications.^[55]

WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.^[56]

WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.^[57][58]

WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.^{[59][60][61][58]}

XTunnel uses SSL/TLS and RC4 to encrypt traffic.^[62][7]

Zebrocy uses SSL and AES ECB for encrypting C2 communications.^[63][64][65]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.