Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
使用该技术的组织
| 组织 | 名称 | 国家 |
|---|---|---|
| grp_g0081 | Tropic Trooper | — |
| grp_g0059 | Magic Hound | Iran |
| grp_g0016 | APT29 | Russia |
| grp_g1002 | BITTER | Pakistan |
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核;置信度与有效期按引用读取。