H3XA — Operational Evidence

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

24 recorded

Relationships

mitigates

from Network Intrusion Prevention

Mitigation

mitigates

from SSL/TLS Inspection

Mitigation

revoked-by

from Custom Cryptographic Protocol

Technique

revoked-by

from Multilayer Encryption

Technique

revoked-by

from Standard Cryptographic Protocol

Technique

subtechnique-of

from Asymmetric Cryptography

Technique

subtechnique-of

from Symmetric Cryptography

Technique

uses

from APT29

Group

uses

Group

uses

from Chaes

Malware

uses

from Cryptoistic

Malware

uses

Malware

uses

Malware

uses

from Gomir

Malware

uses

from KV Botnet Activity

Campaign

uses

from Lizar

Malware

uses

from MacMa

Malware

uses

from Magic Hound

Group

uses

Malware

uses

Malware

uses

Malware

uses

Malware

uses

from Triton Safety Instrumented System Attack

Campaign

uses

from Tropic Trooper

Group

4 external

References

mitre-attack

T1573

SANS Decrypting SSL

http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840

SEI SSL Inspection Risks

https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html

University of Birmingham C2

https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf