H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Asymmetric Cryptography

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).

100 recorded

Relationships

mitigates
from Network Intrusion Prevention
Mitigation
mitigates
from SSL/TLS Inspection
Mitigation
subtechnique-of
to Encrypted Channel
Technique
uses
from adbupd
Malware
uses
from ADVSTORESHELL
Malware
uses
from APT41 DUST
Campaign
uses
from APT42
Group
uses
from Attor
Malware
uses
from BADHATCH
Malware
uses
from Bazar
Malware
uses
from BISCUIT
Malware
uses
from BOLDMOVE
Malware
uses
from BRICKSTORM
Malware
uses
from C0021
Campaign
uses
from Carbon
Malware
uses
from CASTLETAP
Malware
uses
from CHOPSTICK
Malware
uses
from COATHANGER
Malware
uses
from Cobalt Group
Group
uses
from Cobalt Strike
Malware
uses
from ComRAT
Malware
uses
from Covenant
Tool
uses
from Cyclops Blink
Malware
uses
from DarkWatchman
Malware
uses
from DCRAT
Tool
uses
from Doki
Malware
uses
from Dridex
Malware
uses
from Empire
Tool
uses
from FIN6
Group
uses
from FIN8
Group
uses
from FRP
Tool
uses
from Gazer
Malware
uses
from GoldMax
Malware
uses
from Gomir
Malware
uses
from Grandoreiro
Malware
uses
from GreyEnergy
Malware
uses
from GrimAgent
Malware
uses
from HiddenFace
Malware
uses
from Hi-Zor
Malware
uses
from IcedID
Malware
uses
from Indian Critical Infrastructure Intrusions
Campaign
uses
from J-magic
Malware
uses
from KEYPLUG
Malware
uses
from Koadic
Tool
uses
from Kobalos
Malware
uses
from LAMEHUG
Malware
uses
from LITTLELAMB.WOOLTEA
Malware
uses
from Lumma Stealer
Malware
uses
from LunarWeb
Malware
uses
from Machete
Malware
uses
from Mango
Malware
uses
from Medusa Group
Group
uses
from Metamorfo
Malware
uses
from Mispadu
Malware
uses
from Mythic
Tool
uses
from NICECURL
Malware
uses
from OilBooster
Malware
uses
from OilRig
Group
uses
from Operation Wocao
Campaign
uses
from Pay2Key
Malware
uses
from Penquin
Malware
uses
from PITSTOP
Malware
uses
from PoetRAT
Malware
uses
from POSHSPY
Malware
uses
from POWERSTATS
Malware
uses
from Pupy
Tool
uses
from PureCrypter
Malware
uses
from RedCurl
Group
uses
from RedEcho
Group
uses
from Remcos
Tool
uses
from REPTILE
Malware
uses
from REvil
Malware
uses
from Rising Sun
Malware
uses
from Sagerunex
Malware
uses
from Sardonic
Malware
uses
from ServHelper
Malware
uses
from ShinyHunters
Group
uses
from Sliver
Tool
uses
from Small Sieve
Malware
uses
from SnappyTCP
Malware
uses
from SodaMaster
Malware
uses
from SombRAT
Malware
uses
from StrongPity
Malware
uses
from Sykipot
Malware
uses
from TA2541
Group
uses
from TeamPCP Cloud Stealer
Malware
uses
from TinyTurla
Malware
uses
from Tor
Tool
uses
from Trojan.Karagany
Malware
uses
from Tropic Trooper
Group
uses
from Uroburos
Malware
uses
from Velvet Ant
Group
uses
from Versa Director Zero Day Exploitation
Campaign
uses
from Volgmer
Malware
uses
from WannaCry
Malware
uses
from WellMail
Malware
uses
from WellMess
Malware
uses
from Woody RAT
Malware
uses
from XTunnel
Malware
uses
from Zebrocy
Malware
4 external

References

mitre-attack
T1573.002
open
SANS Decrypting SSL
http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840
open
SEI SSL Inspection Risks
https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
open
University of Birmingham C2
https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance