Data Encoding: Standard Encoding

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.^[3]

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.^[4]

APT33 has used base64 to encode command and control traffic.^[5]

Astaroth encodes data using Base64 before sending it to the C2 server. ^[6]

AutoIt backdoor has sent a C2 response that was base64-encoded.^[7]

BabyShark has encoded data using certutil before exfiltration.^[8]

Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.^[9]

BADNEWS encodes C2 traffic with base64.^[7][10][11]

Bisonal has encoded binary data with Base64 and ASCII.^[12][13]

BLINDINGCAN has encoded its C2 traffic with Base64.^[14]

Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.^[15]

BS2005 uses Base64 encoding for communication in the message body of an HTTP request.^[16]

Bumblebee has the ability to base64 encode C2 server responses.^[17]

Carbanak encodes the message body of HTTP traffic with Base64.^[18][19]

Chaes has used Base64 to encode C2 communications.^[20]

CharmPower can send additional modules over C2 encoded with base64.^[21]

ChChes can encode C2 data with a custom technique that utilizes Base64.^[22][23]

Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.^[24]

Cobian RAT obfuscates communications with the C2 server using Base64 encoding.^[25]

CORESHELL C2 messages are Base64-encoded.^[26]

CreepySnail can use Base64 to encode its C2 traffic.^[27]

DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.^[28]

Daserf uses custom base64 encoding to obfuscate HTTP traffic.^[15]

Denis encodes the data sent to the server in Base64.^[29]

Dipsind encodes C2 traffic with base64.^[30]

DnsSystem can Base64 encode data sent to C2.^[31]

down_new has the ability to base64 encode C2 communications.^[32]

Ebury has encoded C2 traffic in hexadecimal format.^[33]

Elise exfiltrates data using cookie values that are Base64-encoded.^[34]

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server.^[35] Additionally, Emotet has used Base64 to encode data before sending to the C2 server.^[36]

Some Felismus samples use a custom method for C2 traffic that utilizes Base64.^[37]

Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.^[38]

Fysbis can use Base64 to encode its C2 traffic.^[39]

gh0st RAT has used Zlib to compress C2 communications data before encrypting it.^[40]

GLASSTOKEN has hexadecimal and Base64 encoded C2 content.^[41]

Gootloader can retrieve a Base64 encoded stager from C2.^[42]

GrimAgent can base64 encode C2 replies.^[43]

HAFNIUM has used ASCII encoding for C2 traffic.^[44]

For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.^[45]

HOPLIGHT has utilized Zlib compression to obfuscate the communications payload. ^[46]

Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.^[47][48]

A JHUHUGIT variant encodes C2 POST data base64.^[49]

Kazuar encodes communications to the C2 server in Base64.^[50]

Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.^[51]

Kevin can Base32 encode chunks of output files during exfiltration.^[52]

KONNI has used a custom base64 key to encode stolen data before exfiltration.^[53]

Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.^[54][55]

A Lazarus Group malware sample encodes data with base64.^[56]

LunarWeb can use Base64 encoding to obfuscate C2 commands.^[57]

Machete has used base64 encoding.^[58]

Mafalda can encode data using Base64 prior to exfiltration.^[59]

Manjusaka communication includes a client-created session cookie with base64-encoded information representing information from the victim system.^[60]

MechaFlounder has the ability to use base16 encoded strings in C2.^[61]

Mis-Type uses Base64 encoding for C2 traffic.^[62]

Misdat network traffic is Base64-encoded plaintext.^[62]

Mongall can use Base64 to encode information sent to its C2.^[63]

More_eggs has used basE91 encoding, along with encryption, for C2 communication.^[64]

Mori can use Base64 encoded JSON libraries used in C2.^[65]

MuddyWater has used tools to encode C2 communications including Base64 encoding.^[66][67]

njRAT uses Base64 encoding for C2 traffic.^[68]

Octopus has encoded C2 communications in Base64.^[69]

Okrum has used base64 to encode C2 communication.^[70]

OopsIE encodes data in hexadecimal format over the C2 channel.^[71]

OSX_OCEANLOTUS.D has used zlib to compress all data after 0x52 for the custom TCP C2 protocol.^[72]

Patchwork used Base64 to encode C2 traffic.^[73]

Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.^[74][75]

PingPull can encode C2 traffic with Base64.^[76]

Responses from the Pisloader C2 server are base32-encoded.^[77]

PowerShower has the ability to encode C2 communications with base64 encoding.^[78][79]

POWERSTATS encoded C2 traffic with base64.^[80]

POWRUNER can use base64 encoded C2 communications.^[81]

Prikormka encodes C2 traffic with Base64.^[82]

PULSECHECK can base-64 encode encrypted data sent through C2.^[83]

QakBot can Base64 encode system information sent to C2.^[84][85]

QUADAGENT encodes C2 communications with base64.^[86]

QUIETCANARY can base64 encode C2 communications.^[87]

Ramsay has used base64 to encode its C2 traffic.^[88]

RDAT can communicate with the C2 via base32-encoded subdomains.^[89]

Revenge RAT uses Base64 to encode information sent to the C2 server.^[90]

RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.^[91]

RotaJakiro uses ZLIB Compression to compresses data sent to the C2 server in the payload section network communication packet.^[92]

S-Type uses Base64 encoding for C2 traffic.^[62]

Saint Bot has used Base64 to encode its C2 communications.^[93]

Samurai can base64 encode data sent in C2 communications prior to its encryption.^[94]

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.^[95]

Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.^[96]

SeaDuke C2 traffic is base64-encoded.^[97]

SideTwist has used Base64 for encoded C2 traffic.^[98]

SLIGHTPULSE can base64 encode all incoming and outgoing C2 messages.^[83]

Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.^[99]

SMOKEDHAM has encoded its C2 traffic with Base64.^[100]

Spark has encoded communications with the C2 server with base64.^[101]

SpeakUp encodes C&C communication using Base64. ^[102]

Squirrelwaffle has encoded its communications to C2 servers using Base64.^[103]

STARWHALE has the ability to hex-encode collected data from an infected host.^[65]

STEADYPULSE can transmit URL encoded data over C2.^[83]

Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.^[104]

SUNBURST used Base64 encoding in its C2 traffic.^[105]

SysUpdate has used Base64 to encode its C2 traffic.^[106]

TA551 has used encoded ASCII text for initial C2 communications.^[107]

Torisma has encoded C2 communications with Base64.^[108]

TrickBot can Base64-encode C2 commands.^[109]

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.^[110]

Valak has returned C2 data as encoded ASCII.^[107]

WARPWIRE can Base64 encode captured credentials with btoa() prior to sending to C2.^[111]

WellMess has used Base64 encoding to uniquely identify communication to and from the C2.^[112]

WIREFIRE can Base64 encode process output sent to C2.^[111]

xCaon has used Base64 to encode its C2 traffic.^[113]

Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.^[114]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.