Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.12
- Destination Certification
- Symmetric vs Asymmetric Cryptography
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0100 | Inception | — |
| grp_g0012 | Darkhotel | South Korea |
| grp_g0038 | Stealth Falcon | — |
| grp_g0128 | ZIRCONIUM | — |
| grp_g0129 | Mustang Panda | China |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0064 | APT33 | Iran |
| grp_g0126 | Higaisa | — |
| grp_g1039 | RedCurl | Russia |
| grp_g1052 | Contagious Interview | — |
| grp_g0069 | MuddyWater | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0060 | BRONZE BUTLER | — |
| grp_g0007 | APT28 | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.