View on MITRE ATT&CK

T1573 - Encrypted Channel

Tactics:
Command and Control
Platforms:
ESXi Linux macOS Network Devices +1
Detection:
Not specified
Description:
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Sub-techniques (2)
ID ATT&CK Actions
T1573.001 Symmetric Cryptography
T1573.002 Asymmetric Cryptography
Used by Actors (4)
APT29
Nation-state
Magic Hound
Unknown
BITTER
Unknown
Tropic Trooper
Unknown
Malware (11)
RCSession other NETWIRE other Gomir other Emotet other PowerLess other Chaes other gh0st RAT other Cryptoistic other MacMa other PowGoop other Lizar other
Metadata
MITRE ID: T1573
STIX ID: attack-pattern--b8902400-e6c5-...
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Created: 13/01/2026 17:48
Updated: 21/04/2026 04:00