T1573.002: Asymmetric Cryptography — MITRE ATT&CK Technique

Description

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Mitigations (2)

Network Intrusion PreventionM1031

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

SSL/TLS InspectionM1020

SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.

Threat Groups (12)

ID	Group	Context
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 20...
G1042	RedEcho	[RedEcho](https://attack.mitre.org/groups/G1042) uses SSL for network communication.(Citation: RecordedFuture RedEcho 2021)
G1018	TA2541	[TA2541](https://attack.mitre.org/groups/G1018) has used TLS encrypted C2 communications including for campaigns using AsyncRAT.(Citation: Cisco Opera...
G0049	OilRig	[OilRig](https://attack.mitre.org/groups/G0049) used the [PowerExchange](https://attack.mitre.org/software/S1173) utility and other tools to create tu...
G0081	Tropic Trooper	[Tropic Trooper](https://attack.mitre.org/groups/G0081) has used SSL to connect to C2 servers.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation:...
G1039	RedCurl	[RedCurl](https://attack.mitre.org/groups/G1039) has used HTTPS for C2 communication.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
G1051	Medusa Group	[Medusa Group](https://attack.mitre.org/groups/G1051) has used HTTPS for command and control.(Citation: CISA Medusa Group Medusa Ransomware March 2025...
G1044	APT42	[APT42](https://attack.mitre.org/groups/G1044) has used tools such as [NICECURL](https://attack.mitre.org/software/S1192) with command and control com...
G0080	Cobalt Group	[Cobalt Group](https://attack.mitre.org/groups/G0080) has used the Plink utility to create SSH tunnels.(Citation: Group IB Cobalt Aug 2017)
G1047	Velvet Ant	[Velvet Ant](https://attack.mitre.org/groups/G1047) has used a reverse SSH shell to securely communicate with victim devices.(Citation: Sygnia VelvetA...
G0061	FIN8	[FIN8](https://attack.mitre.org/groups/G0061) has used the Plink utility to tunnel RDP back to C2 infrastructure.(Citation: FireEye Know Your Enemy FI...
G1057	ShinyHunters	[ShinyHunters](https://attack.mitre.org/groups/G1057) has established a connection between the staging host and the C2 using SSH.(Citation: Google_SHO...

Associated Software (80)

ID	Name	Type	Context
S9015	BRICKSTORM	Malware	[BRICKSTORM](https://attack.mitre.org/software/S9015) has communicated with C2 infrastructure via TLS.(Citation: CrowdStrike BRICKSTORM WARP PANDA UNC...
S1192	NICECURL	Malware	[NICECURL](https://attack.mitre.org/software/S1192) has used HTTPS for C2 communications.(Citation: Mandiant APT42-untangling)
S1105	COATHANGER	Malware	[COATHANGER](https://attack.mitre.org/software/S1105) connects to command and control infrastructure using SSL.(Citation: NCSC-NL COATHANGER Feb 2024)
S1085	Sardonic	Malware	[Sardonic](https://attack.mitre.org/software/S1085) has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers b...
S0202	adbupd	Malware	[adbupd](https://attack.mitre.org/software/S0202) contains a copy of the OpenSSL library to encrypt C2 traffic.(Citation: Microsoft PLATINUM April 201...
S1224	CASTLETAP	Malware	[CASTLETAP](https://attack.mitre.org/software/S1224) can initiate a C2 connection over an SSL socket.(Citation: Mandiant Fortinet Zero Day)
S1121	LITTLELAMB.WOOLTEA	Malware	[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) can communicate over SSL using the private key from the Ivanti Connect Secure web server...
S0491	StrongPity	Malware	[StrongPity](https://attack.mitre.org/software/S0491) has encrypted C2 traffic using SSL/TLS.(Citation: Talos Promethium June 2020)
S0668	TinyTurla	Malware	[TinyTurla](https://attack.mitre.org/software/S0668) has the ability to encrypt C2 traffic with SSL/TLS.(Citation: Talos TinyTurla September 2021)
S1203	J-magic	Malware	[J-magic](https://attack.mitre.org/software/S1203) can communicate back to send a challenge to C2 infrastructure over SSL.(Citation: Lumen J-Magic JAN...
S0342	GreyEnergy	Malware	[GreyEnergy](https://attack.mitre.org/software/S0342) encrypts communications using RSA-2048.(Citation: ESET GreyEnergy Oct 2018)
S1198	Gomir	Malware	[Gomir](https://attack.mitre.org/software/S1198) uses reverse proxy functionality that employs SSL to encrypt communications.(Citation: Symantec Troll...
S1184	BOLDMOVE	Malware	[BOLDMOVE](https://attack.mitre.org/software/S1184) uses the WolfSSL library to implement SSL encryption for command and control communication.(Citati...
S1081	BADHATCH	Malware	[BADHATCH](https://attack.mitre.org/software/S1081) can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.(Citation: Gigamon BA...
S0409	Machete	Malware	[Machete](https://attack.mitre.org/software/S0409) has used TLS-encrypted FTP to exfiltrate data.(Citation: Cylance Machete Mar 2017)
S0514	WellMess	Malware	[WellMess](https://attack.mitre.org/software/S0514) can communicate to C2 with mutual TLS where client and server mutually check certificates.(Citatio...
S1065	Woody RAT	Malware	[Woody RAT](https://attack.mitre.org/software/S1065) can use RSA-4096 to encrypt data sent to its C2 server.(Citation: MalwareBytes WoodyRAT Aug 2022)...
S0615	SombRAT	Malware	[SombRAT](https://attack.mitre.org/software/S0615) can SSL encrypt C2 traffic.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHa...
S0180	Volgmer	Malware	Some [Volgmer](https://attack.mitre.org/software/S0180) variants use SSL to encrypt C2 communications.(Citation: US-CERT Volgmer Nov 2017)
S1122	Mispadu	Malware	[Mispadu](https://attack.mitre.org/software/S1122) contains a copy of the OpenSSL library to encrypt C2 traffic.(Citation: Segurança Informática URSA ...

References

Frequently Asked Questions

What is T1573.002 (Asymmetric Cryptography)?

T1573.002 is a MITRE ATT&CK technique named 'Asymmetric Cryptography'. It belongs to the Command and Control tactic(s). Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric c...

How can T1573.002 be detected?

Detection of T1573.002 (Asymmetric Cryptography) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1573.002?

There are 2 documented mitigations for T1573.002. Key mitigations include: Network Intrusion Prevention, SSL/TLS Inspection.

Which threat groups use T1573.002?

Known threat groups using T1573.002 include: FIN6, RedEcho, TA2541, OilRig, Tropic Trooper, RedCurl, Medusa Group, APT42.