value:  Cobalt Group has used the Plink utility to create SSH tunnels. ;; Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server. ;; ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel. ;; Doki has used the embedTLS library for network communications. ;; Dridex has encrypted traffic with RSA. ;; Emotet is known to use RSA keys for encrypting C2 traffic. ;; Empire can use TLS to encrypt its C2 channel. ;; FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers. ;; FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure. ;; Gazer uses custom encryption for C2 that uses RSA. ;; GoldMax has RSA-encrypted its communication with the C2 server. ;; Grandoreiro can use SSL in C2 communication. ;; GreyEnergy encrypts communications using RSA-2048. ;; Hi-Zor encrypts C2 traffic with TLS. ;; IcedID has used SSL and TLS in communications with C2. ;; Koadic can use SSL and TLS for communications. ;; Machete has used TLS-encrypted FTP to exfiltrate data. ;; Metamorfo's C2 communication has been encrypted using OpenSSL. ;; OilRig used the Plink utility and other tools to create tunnels to C2 servers. ;; Operation Wocao's proxy implementation Agent" can upgrade the socket in use to a TLS socket. ;; Pay2Key has used RSA encrypted communications with C2. ;; Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman. ;; PoetRAT used TLS to encrypt command and control (C2) communications. ;; POSHSPY encrypts C2 traffic with AES and RSA. ;; POWERSTATS has encrypted C2 traffic with RSA. ;; Pupy's default encryption for its C2 communication channel is SSL but it also has transport options for RSA and AES. ;; REvil has encrypted C2 communications with the ECIES algorithm. ;; ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim such as RDP. ;; StrongPity has encrypted C2 traffic using SSL/TLS. ;; Sykipot uses SSL for encrypting C2 communications. ;; Tor encapsulates traffic in multiple layers of encryption using TLS by default. ;; Trojan.Karagany can secure C2 communications with SSL and TLS. ;; Tropic Trooper has used SSL to connect to C2 servers. ;; Some Volgmer variants use SSL to encrypt C2 communications. ;; WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit. ;; WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS. ;; WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates. ;; XTunnel uses SSL/TLS and RC4 to encrypt traffic. ;; Zebrocy uses SSL and AES ECB for encrypting C2 communications. "
name: Encrypted Channel: Asymmetric Cryptography