Forensia CTI Core

About

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Platforms: ESXi, Linux, macOS, Network Devices, WindowsParent: T1573 Encrypted ChannelMITRE ATT&CK ↗

Used by actors

14 known groups

G0007 APT28 G0012 Darkhotel G0032 Lazarus Group G0038 Stealth Falcon G0060 BRONZE BUTLER G0064 APT33 G0069 MuddyWater G0100 Inception G0126 Higaisa G0128 ZIRCONIUM G0129 Mustang Panda G1017 Volt Typhoon G1039 RedCurl G1052 Contagious Interview

Software

166 malware/tools implement this

RIPTIDEHikitLuridTaidoorPoisonIvyPlugXDerusbiUroburosCHOPSTICKCarbanakgh0st RATNETEAGLEHAMMERTOSSDuquADVSTORESHELLCosmicDukeSeaDukeSys104H RAT3PARA RAThttpclientSakulaFakeMCallMeEliseEmissaryHi-ZorEpicPrikormkaBBSRATBADNEWSH1N1DowndelphCORESHELLWinnti for WindowsChChesRTMMoonWindRedLeavesCobalt StrikeSNUGRIDEKomplexGazerHelminthFelismusVolgmerFALLCHILLDaserfNETWIREDipsindHydraqChaosZeroTBandookComnieBADCALLPLAINTEEMosquitoInvisiMoleQuasarRATTrickBotBisonalKEYMARBLENDiskMonitorUPPERCUTMore_eggsUBoatRATNanoCoreGreyEnergyAzorultCardinal RATOSX_OCEANLOTUS.DKONNIEmotetPOWERTONEburyFlawedAmmyyDridexHiddenWaspLightNeuronMacheteWinnti for LinuxHotCroissantRifdoorPLEADTSCookieAttorOkrumMetamorfodown_newBonadanRDATPipeMonFatDukeWellMessBLINDINGCANLuciferBazarHyperStackSUNBURSTExplosiveBendyBearLookBackTAINTEDSCRIBEStuxnetSideTwistSombRATSodaMasterRainyDayNebulaeGrimAgentSliverKobalosSMOKEDHAMQakBotxCaonXCSSETFoggyWebSysUpdatePandoraWarzoneRATCharmPowerTorismaIceAppleMongallPingPullStrifeWaterBumblebeemetaMainMafaldaWoody RATQUIETCANARYRotaJakiroSardonicSamuraiNinjaNGLiteSLIGHTPULSEZIPLINEWIREFIRELIGHTWIRELunarWebFRPPikabotLatrodectusSolarMangoTAMECATTroll StealerLockBit 3.0VIRTUALPIERIFLESPINETHINCRUSTCASTLETAPBOOKWORMStarProxyPUBLOADHavocTONESHELLSystemBCHTTPTroyPureCrypterLODEINFOHiddenFaceMuddyViperRustyWater

Corpus indicators tagged with this technique

911 indicators in the corpus carry T1573.001.

Indicator	Type	Family	Sev	Src
cve-2026-3102	cve	—	85	3
cve-2021-27076	cve	—	85	1
ca5fd64932a82d3e24a19fe94d8b7636847f4335b8fd8795a63cfa0107e67048	hash	—	80	2
af93524fd0aac0a790734a0747fcf844ba5f0652b11a0f4a59bbe5aeace0fa75	hash	—	80	2
a806cece4a4fbbe502e6d76035681702d9adde1c6f74c9e1c0547d37d30ddfcf	hash	—	80	2
bf0b36dcbbc60dbf83ecac7c56534271e53a16817909306ecc6f15f7b6106730	hash	—	80	2
c8075bbff748096e1c6a1ea0aa67bb6762fdd7551427a12425b35b94c1f1ecf2	sha256	supply_chain	80	1
17832aa629524ef6e8d8d6e9b6b902a8d324b559e3c36dbd0e221ab1690be871	sha256	supply_chain	80	1
3a69aedb78677993384dfe9b476e3d26	hash	—	80	2
51ead7f0490bfe6b432120bbbd63b807277d016911664fb264640bb8b007d756	hash	—	80	2
2e04dc8bee038a5771373fc4dbaa4e45f653cd649928199e9ce8098c8b27d64e	hash	—	80	2
a29cdca72822c1f236c53c181d03f0c45907a45f2ef3c4c2da3ef839bfd3b7a6	hash	—	80	2
bbcc1a208b4bd0a9ffe8799158cd994d82e125acb30b630e774b242f11dd6985	hash	—	80	2
1a92cf241f86584361097d5735948a8170007206db56fe88739c9048767ab862	hash	—	80	2
e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c	sha256	—	80	1
f6669bd504ce6b0e303be7ee47f2ebbc062989c88c41f0a3f436044a24869798	sha256	supply_chain	80	1
e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4	hash	phishing	80	2
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470	sha256	—	80	1
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9	sha256	—	80	1
164e322d6fbc62e254d73583acd7f39444c884d3f5e6a5d27db143fc25bc88b3	sha256	supply_chain	80	1
2227df1207d2c90db46610bd98909032	hash	—	80	2
0a14b993fdac34f7a05b6d9d22f5fa9cfc711134	hash	—	80	2
2a6f0837007726a1863f2180a9a84a89284dc57e7557857e2a3d1896a69fe6c7	hash	—	80	2
55c0235188c16bd2e18a21fa78d9a39c220b8b73	hash	—	80	2
50ffce607867d8fa8eaf6ef5cd25a3c0e7e4415e881b9e55c04a67bcddb74fdf	sha256	supply_chain	80	1
79aec671ceb205db1769da6898c9659c7c8297b13929e593050523438c09a44f	hash	—	80	2
282b9bc318ad1234cbd1b86424b784299b8be31545802a7c6b751166b814b990	sha256	supply_chain	80	1
22c860931f2ed22897b81ef8da16980fc24b2573ec884a153b3ff5df9e0f8cff	hash	—	80	2
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21	sha256	—	80	1
69f524815eeb3b2069ff41a8a12cae0537de8ad9bd856d694fa21bb2af8fada8	hash	—	80	2

Showing the top 30 by severity of 911.