Technique:  Encrypted Channel:Asymmetric Cryptography
adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.
A variant of ADVSTORESHELL encrypts some C2 with RSA.
Attor's Blowfish key is encrypted with a public RSA key.
BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.
Bazar can use TLS in C2 communications.
BISCUIT uses SSL for encrypting C2 communications.
During C0021, the threat actors used SSL via TCP port 443 for C2 communications.
Carbon has used RSA encryption for C2 communications.
CHOPSTICK encrypts C2 communications with TLS.
It has used the Plink utility to create SSH tunnels.
Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.
ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.
Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.
DarkWatchman can use TLS to encrypt its C2 channel.
Doki has used the embedTLS library for network communications.
Dridex has encrypted traffic with RSA.
Emotet is known to use RSA keys for encrypting C2 traffic.
Empire can use TLS to encrypt its C2 channel.
It used the Plink command-line utility to create SSH tunnels to C2 servers.
It has used the Plink utility to tunnel RDP back to C2 infrastructure.
Gazer uses custom encryption for C2 that uses RSA.
GoldMax has RSA-encrypted its communication with the C2 server.
Grandoreiro can use SSL in C2 communication.
GreyEnergy encrypts communications using RSA-2048.
GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.
Hi-Zor encrypts C2 traffic with TLS.
IcedID has used SSL and TLS in communications with C2.
KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2.
Koadic can use SSL and TLS for communications.
Kobalos's authentication and key exchange is performed using RSA-512.
It has used TLS-encrypted FTP to exfiltrate data.
Metamorfo's C2 communication has been encrypted using OpenSSL.
Mythic supports SSL encrypted C2.
It used the Plink utility and other tools to create tunnels to C2 servers.
During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.
Pay2Key has used RSA encrypted communications with C2.
Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.
PoetRAT used TLS to encrypt command and control (C2) communications.
POSHSPY encrypts C2 traffic with AES and RSA.
POWERSTATS has encrypted C2 traffic with RSA.
Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.
REvil has encrypted C2 communications with the ECIES algorithm.
Rising Sun variants can use SSL for encrypting C2 communications.
Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.
ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.
Sliver can use mutual TLS and RSA  cryptography to exchange a session key.
Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.
SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.
SombRAT can SSL encrypt C2 traffic.
StrongPity has encrypted C2 traffic using SSL/TLS.
Sykipot uses SSL for encrypting C2 communications.
It has used TLS encrypted C2 communications including for campaigns using AsyncRAT.
TinyIt has the ability to encrypt C2 traffic with SSL/TLS.
Tor encapsulates traffic in multiple layers of encryption, using TLS by default.
Trojan.Karagany can secure C2 communications with SSL and TLS.
It has used SSL to connect to C2 servers.
Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.
Some Volgmer variants use SSL to encrypt C2 communications.
WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.
WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.
WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.
Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.
XTunnel uses SSL/TLS and RC4 to encrypt traffic.
Zebrocy uses SSL and AES ECB for encrypting C2 communications.