H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Symmetric Cryptography

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

187 recorded

Relationships

mitigates
from Network Intrusion Prevention
Mitigation
subtechnique-of
to Encrypted Channel
Technique
uses
from 3CX Supply Chain Attack
Campaign
uses
from 3PARA RAT
Malware
uses
from 4H RAT
Malware
uses
from ADVSTORESHELL
Malware
uses
from APT28
Group
uses
from APT33
Group
uses
from Attor
Malware
uses
from Azorult
Malware
uses
from BADCALL
Malware
uses
from BADNEWS
Malware
uses
from Bandook
Malware
uses
from Bazar
Malware
uses
from BBSRAT
Malware
uses
from BendyBear
Malware
uses
from Bisonal
Malware
uses
from BLINDINGCAN
Malware
uses
from Bonadan
Malware
uses
from BOOKWORM
Malware
uses
from BRONZE BUTLER
Group
uses
from Bumblebee
Malware
uses
from CallMe
Malware
uses
from Carbanak
Malware
uses
from Cardinal RAT
Malware
uses
from CASTLETAP
Malware
uses
from Chaos
Malware
uses
from CharmPower
Malware
uses
from ChChes
Malware
uses
from CHOPSTICK
Malware
uses
from Cobalt Strike
Malware
uses
from Comnie
Malware
uses
from Contagious Interview
Group
uses
from CORESHELL
Malware
uses
from CosmicDuke
Malware
uses
from Darkhotel
Group
uses
from Daserf
Malware
uses
from Derusbi
Malware
uses
from Dipsind
Malware
uses
from Downdelph
Malware
uses
from down_new
Malware
uses
from Dridex
Malware
uses
from Duqu
Malware
uses
from Ebury
Malware
uses
from Elise
Malware
uses
from Emissary
Malware
uses
from Emotet
Malware
uses
from Epic
Malware
uses
from Explosive
Malware
uses
from FakeM
Malware
uses
from FALLCHILL
Malware
uses
from FatDuke
Malware
uses
from Felismus
Malware
uses
from FlawedAmmyy
Malware
uses
from FoggyWeb
Malware
uses
from Frankenstein
Campaign
uses
from FRP
Tool
uses
from Gazer
Malware
uses
from gh0st RAT
Malware
uses
from GreyEnergy
Malware
uses
from GrimAgent
Malware
uses
from H1N1
Malware
uses
from HAMMERTOSS
Malware
uses
from Havoc
Malware
uses
from Helminth
Malware
uses
from HiddenFace
Malware
uses
from HiddenWasp
Malware
uses
from Higaisa
Group
uses
from Hikit
Malware
uses
from Hi-Zor
Malware
uses
from HotCroissant
Malware
uses
from httpclient
Malware
uses
from HTTPTroy
Malware
uses
from Hydraq
Malware
uses
from HyperStack
Malware
uses
from IceApple
Malware
uses
from Inception
Group
uses
from InvisiMole
Malware
uses
from KEYMARBLE
Malware
uses
from Kobalos
Malware
uses
from Komplex
Malware
uses
from KONNI
Malware
uses
from Latrodectus
Malware
uses
from Lazarus Group
Group
uses
from LightNeuron
Malware
uses
from LIGHTWIRE
Malware
uses
from LockBit 3.0
Malware
uses
from LODEINFO
Malware
uses
from LookBack
Malware
uses
from Lucifer
Malware
uses
from LunarWeb
Malware
uses
from Lurid
Malware
uses
from Machete
Malware
uses
from Mafalda
Malware
uses
from Mango
Malware
uses
from metaMain
Malware
uses
from Metamorfo
Malware
uses
from Mongall
Malware
uses
from MoonWind
Malware
uses
from More_eggs
Malware
uses
from Mosquito
Malware
uses
from MuddyViper
Malware
uses
from MuddyWater
Group
uses
from Mustang Panda
Group
uses
from NanoCore
Malware
uses
from NDiskMonitor
Malware
uses
from Nebulae
Malware
uses
from NETEAGLE
Malware
uses
from NETWIRE
Malware
uses
from NGLite
Malware
uses
from Ninja
Malware
uses
from Okrum
Malware
uses
from Operation Dream Job
Campaign
uses
from OSX_OCEANLOTUS.D
Malware
uses
from Pandora
Malware
uses
from Pikabot
Malware
uses
from PingPull
Malware
uses
from PipeMon
Malware
uses
from PLAINTEE
Malware
uses
from PLEAD
Malware
uses
from PlugX
Malware
uses
from PoisonIvy
Malware
uses
from POWERTON
Malware
uses
from Prikormka
Malware
uses
from PUBLOAD
Malware
uses
from PureCrypter
Malware
uses
from QakBot
Malware
uses
from QuasarRAT
Tool
uses
from QUIETCANARY
Malware
uses
from RainyDay
Malware
uses
from RDAT
Malware
uses
from RedCurl
Group
uses
from RedLeaves
Malware
uses
from RedPenguin
Campaign
uses
from Rifdoor
Malware
uses
from RIFLESPINE
Malware
uses
from RIPTIDE
Malware
uses
from RotaJakiro
Malware
uses
from RTM
Malware
uses
from RustyWater
Malware
uses
from Sakula
Malware
uses
from Samurai
Malware
uses
from Sardonic
Malware
uses
from SeaDuke
Malware
uses
from SideTwist
Malware
uses
from SLIGHTPULSE
Malware
uses
from Sliver
Tool
uses
from SMOKEDHAM
Malware
uses
from SNUGRIDE
Malware
uses
from SodaMaster
Malware
uses
from Solar
Malware
uses
from SombRAT
Malware
uses
from StarProxy
Malware
uses
from Stealth Falcon
Group
uses
from StrifeWater
Malware
uses
from Stuxnet
Malware
uses
from SUNBURST
Malware
uses
from Sys10
Malware
uses
from SystemBC
Malware
uses
from SysUpdate
Malware
uses
from Taidoor
Malware
uses
from TAINTEDSCRIBE
Malware
uses
from TAMECAT
Malware
uses
from TeamPCP Cloud Stealer
Malware
uses
from THINCRUST
Malware
uses
from TONESHELL
Malware
uses
from Torisma
Malware
uses
from TrickBot
Malware
uses
from Troll Stealer
Malware
uses
from TSCookie
Malware
uses
from UBoatRAT
Malware
uses
from UPPERCUT
Malware
uses
from Uroburos
Malware
uses
from VIRTUALPIE
Malware
uses
from Volgmer
Malware
uses
from Volt Typhoon
Group
uses
from WarzoneRAT
Malware
uses
from WellMess
Malware
uses
from Winnti for Linux
Malware
uses
from Winnti for Windows
Malware
uses
from WIREFIRE
Malware
uses
from Woody RAT
Malware
uses
from xCaon
Malware
uses
from XCSSET
Malware
uses
from ZeroT
Malware
uses
from ZIPLINE
Malware
uses
from ZIRCONIUM
Group
2 external

References

mitre-attack
T1573.001
open
University of Birmingham C2
https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance