Description
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
Platforms
Mitigations (1)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Threat Groups (14)
| ID | Group | Context |
|---|---|---|
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used a version of the Awen web shell that employed AES encryption and decryption for C2 comm... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used AES to encrypt C2 responses.(Citation: Talos MuddyWater Jan 2022) |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has encrypted C2 communications with RC4.(Citation: Eset PlugX Korplug Mustang Panda March 2022... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used AES encrypted communications in C2.(Citation: Zscaler APT31 Covid-19 October 2020) |
| G1052 | Contagious Interview | [Contagious Interview](https://attack.mitre.org/groups/G1052) has encrypted C2 traffic using RC4.(Citation: Sekoia ClickFake 2025) |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) used AES-128 to encrypt C2 traffic.(Citation: Zscaler Higaisa 2020) |
| G1039 | RedCurl | [RedCurl](https://attack.mitre.org/groups/G1039) has used AES-128 CBC to encrypt C2 communications.(Citation: group-ib_redcurl2) |
| G0038 | Stealth Falcon | [Stealth Falcon](https://attack.mitre.org/groups/G0038) malware encrypts C2 traffic using RC4 with a hard-coded key.(Citation: Citizen Lab Stealth Fal... |
| G0060 | BRONZE BUTLER | [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traff... |
| G0012 | Darkhotel | [Darkhotel](https://attack.mitre.org/groups/G0012) has used AES-256 and 3DES for C2 communications.(Citation: Microsoft DUBNIUM July 2016) |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) installed a Delphi backdoor that used a custom algorithm for C2 communications.(Citation: ESET Zebrocy ... |
| G0032 | Lazarus Group | Several [Lazarus Group](https://attack.mitre.org/groups/G0032) malware families encrypt C2 traffic using custom code that uses XOR with an ADD operati... |
| G0100 | Inception | [Inception](https://attack.mitre.org/groups/G0100) has encrypted network communications with AES.(Citation: Kaspersky Cloud Atlas December 2014) |
| G0064 | APT33 | [APT33](https://attack.mitre.org/groups/G0064) has used AES for encryption of command and control traffic.(Citation: FireEye APT33 Guardrail) |
Associated Software (167)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.(Citation: Fidelis Tr... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has encrypted its C2 traffic with RC4.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can XOR and AES encrypt C2 messages.(Citation: Kaspersky ToddyCat June 2022) |
| S1145 | Pikabot | Malware | Earlier [Pikabot](https://attack.mitre.org/software/S1145) variants use a custom encryption procedure leveraging multiple mechanisms including AES wit... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can encrypt C2 requests and responses with RC4(Citation: Proofpoint Bumblebee April 2022) |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) has encrypted its C2 communications using XOR and VEST-32.(Citation: McAfee Lazarus Nov 2020) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) encodes the payload of system information sent to the command and control servers using a one byte ... |
| S0134 | Downdelph | Malware | [Downdelph](https://attack.mitre.org/software/S0134) uses RC4 to encrypt C2 responses.(Citation: ESET Sednit Part 3) |
| S1078 | RotaJakiro | Malware | [RotaJakiro](https://attack.mitre.org/software/S1078) encrypts C2 communication using a combination of AES, XOR, ROTATE encryption, and ZLIB compressi... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 server... |
| S0082 | Emissary | Malware | The C2 server response to a beacon sent by a variant of [Emissary](https://attack.mitre.org/software/S0082) contains a 36-character GUID value that is... |
| S0271 | KEYMARBLE | Malware | [KEYMARBLE](https://attack.mitre.org/software/S0271) uses a customized XOR algorithm to encrypt C2 communications.(Citation: US-CERT KEYMARBLE Aug 201... |
| S1193 | TAMECAT | Malware | [TAMECAT](https://attack.mitre.org/software/S1193) has used AES to encrypt C2 traffic.(Citation: Mandiant APT42-untangling) |
| S1224 | CASTLETAP | Malware | [CASTLETAP](https://attack.mitre.org/software/S1224) can receive a 9-byte XOR encrypted activation string in the payload of an ICMP echo request packe... |
| S0153 | RedLeaves | Malware | [RedLeaves](https://attack.mitre.org/software/S0153) has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.(Citation: PWC ... |
| S0171 | Felismus | Malware | Some [Felismus](https://attack.mitre.org/software/S0171) samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.(Ci... |
| S1229 | Havoc | Malware | [Havoc](https://attack.mitre.org/software/S1229) can send an AES encrypted check-in request to the C2 server.(Citation: Zscaler Havoc FEB 2023)(Citati... |
| S0653 | xCaon | Malware | [xCaon](https://attack.mitre.org/software/S0653) has encrypted data sent to the C2 server using a XOR key.(Citation: Checkpoint IndigoZebra July 2021)... |
| S0254 | PLAINTEE | Malware | [PLAINTEE](https://attack.mitre.org/software/S0254) encodes C2 beacons using XOR.(Citation: Rancor Unit42 June 2018) |
| S0630 | Nebulae | Malware | [Nebulae](https://attack.mitre.org/software/S0630) can use RC4 and XOR to encrypt C2 communications.(Citation: Bitdefender Naikon April 2021) |
References
Frequently Asked Questions
What is T1573.001 (Symmetric Cryptography)?
T1573.001 is a MITRE ATT&CK technique named 'Symmetric Cryptography'. It belongs to the Command and Control tactic(s). Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric enc...
How can T1573.001 be detected?
Detection of T1573.001 (Symmetric Cryptography) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1573.001?
There are 1 documented mitigations for T1573.001. Key mitigations include: Network Intrusion Prevention.
Which threat groups use T1573.001?
Known threat groups using T1573.001 include: Volt Typhoon, MuddyWater, Mustang Panda, ZIRCONIUM, Contagious Interview, Higaisa, RedCurl, Stealth Falcon.