Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0081 | Tropic Trooper | — |
| grp_g0059 | Magic Hound | Iran |
| grp_g0016 | APT29 | Russia |
| grp_g1002 | BITTER | Pakistan |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.