H3XA — Operational Evidence

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.

1 recorded

Relationships

revoked-by

to Encrypted Channel

Technique

5 external

References

mitre-attack

T1079

open

SANS Decrypting SSL

http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840

open

SEI SSL Inspection Risks

https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html

open

Fidelis DarkComet

https://www.fidelissecurity.com/sites/default/files/FTA_1018_looking_at_the_sky_for_a_dark_comet.pdf

open

University of Birmingham C2

https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf

open