Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1573.001: Symmetric Cryptography

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

EnterpriseT1573.001Sub-techniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Symmetric Cryptography is a command-and-control sub-technique where adversaries encrypt C2 traffic with a shared-key algorithm such as AES, DES, 3DES, Blowfish, or RC4 instead of relying only on the security features of the underlying protocol. For leaders, the issue is visibility: encrypted malware traffic can reduce the value of basic network inspection and make incident scoping harder across Windows, Linux, macOS, ESXi, and network devices.

Executive priority

Treat this as a resilience and monitoring coverage question, not just a malware detail. Security leaders should ask whether SOC and incident response teams can identify suspicious encrypted outbound traffic patterns, whether network boundary controls can block known malicious traffic, and whether coverage extends beyond endpoints to ESXi and network devices. The relationship set includes multiple campaigns, groups, and malware families using this behavior, so it is a useful control-validation scenario for threat-informed defense and audit evidence around C2 monitoring.

Technical view

ATT&CK provides no native detection text for this sub-technique, but it is linked to DET0143, a detection strategy for encrypted channels via symmetric cryptography across OS platforms. Detection engineering should focus on validating visibility into command-and-control indicators around encrypted sessions: unusual destinations, ports, timing, volume, protocol mismatch, encrypted payloads over nonstandard channels, and malware/configuration evidence where keys or algorithms may be present. IR teams should not assume decryption is possible; the parent technique notes that implementations may be reverse engineered if secret keys are encoded or generated within malware samples or configuration files.

Likely telemetry

  • Network flow records and session metadata at egress points
  • IDS/IPS alerts and signatures at network boundaries
  • Proxy, firewall, and secure web gateway logs where applicable
  • DNS and destination reputation context correlated with outbound encrypted traffic
  • Endpoint process-to-network connection telemetry across Windows, Linux, macOS, and ESXi where available

Detection direction

  • Validate the DET0143-aligned detection strategy against local telemetry rather than assuming encryption inspection alone will find this behavior.
  • Tune for behavioral indicators of C2 over encrypted channels, including rare destinations, unusual beaconing cadence, unexpected protocols or ports, and process/network relationships.
  • Account for false positives from legitimate encrypted business applications, administrative tooling, backups, software updates, and device management traffic.
  • Prioritize visibility gaps on ESXi and network devices, where endpoint-style telemetry may be thinner than on user workstations or servers.
  • Use relationship context to inform threat hunting: this behavior is associated in ATT&CK with several campaigns, groups, and software entries, but local indicators and environment-specific baselines are required before drawing attribution conclusions.

Mitigation priorities

  • Apply M1031 Network Intrusion Prevention by using intrusion detection signatures to block traffic at network boundaries where reliable signatures exist.
  • Strengthen egress monitoring and policy enforcement so unexpected outbound encrypted channels are visible and reviewable.
  • Maintain baselines for normal encrypted traffic by platform and business function to support SOC triage.
  • Ensure incident response playbooks include collection of network metadata and malware/configuration artifacts when encrypted C2 is suspected.
  • Extend monitoring and control validation to network devices and ESXi systems, not only traditional endpoints.
Analyst notes and limits

This object is a command-and-control sub-technique under Encrypted Channel. Its business value is in testing whether defenders can still make decisions when C2 content is hidden by known symmetric encryption. The supplied relationships show usage by multiple ATT&CK campaigns, groups, and software, including examples spanning Windows malware and network-device-focused activity, but those relationships should be used for prioritization and hunting context rather than direct attribution.

The official ATT&CK detection field is not provided, and the supplied DET0143 relationship does not include detailed detection logic in the provided fields. This take does not assert active exploitation, customer exposure, or guaranteed detection. Effective validation depends on local network architecture, logging coverage, inspection policy, and available malware or configuration artifacts.

Official MITRE ATT&CK definition

Symmetric Cryptography

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Group Enterprise

G0012: Darkhotel

Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.[1][2][3]

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G0128: ZIRCONIUM

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.[1][2]

Group Enterprise

G1017: Volt Typhoon

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].

Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]

Malware Enterprise

S0384: Dridex

Dridex is a prolific banking Trojan that first appeared in 2014. By December 2019, the US Treasury estimated Dridex had infected computers in hundreds of banks and financial institutions in over 40 countries, leading to more than $100 million in theft. Dridex was created from the source code of the Bugat banking Trojan (also known as Cridex).[1][2][3]

Windows
Malware Enterprise

S0649: SMOKEDHAM

SMOKEDHAM is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.[1][2]

Windows
Malware Enterprise

S0260: InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

Windows
Malware Enterprise

S0367: Emotet

Emotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID. Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.[1]

Windows
Malware Enterprise

S0113: Prikormka

Prikormka is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. [1]

Windows
Malware Enterprise

S1202: LockBit 3.0

LockBit 3.0 is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and BlackCat ransomware. LockBit 3.0 has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as LockBit 2.0.[1][2][3][4]

Windows
Malware Enterprise

S0034: NETEAGLE

NETEAGLE is a backdoor developed by APT30 with compile dates as early as 2008. It has two main variants known as “Scout” and “Norton.” [1]

Windows
Malware Enterprise

S0344: Azorult

Azorult is a commercial Trojan that is used to steal information from compromised hosts. Azorult has been observed in the wild as early as 2016. In July 2018, Azorult was seen used in a spearphishing campaign against targets in North America. Azorult has been seen used for cryptocurrency theft. [1][2]

Windows
Campaign Enterprise

C0022: Operation Dream Job

Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · Malware S0384: Dridex Enterprise uses · Malware S0649: SMOKEDHAM Enterprise uses · Malware S0260: InvisiMole Enterprise uses · Malware S1227: StarProxy Enterprise uses · Malware S0663: SysUpdate Enterprise uses · Malware S0367: Emotet Enterprise uses · Malware S0113: Prikormka Enterprise uses · Malware S0066: 3PARA RAT Enterprise uses · Malware S1202: LockBit 3.0 Enterprise uses · Malware S0034: NETEAGLE Enterprise uses · Malware S0409: Machete Enterprise uses · Malware S0344: Azorult Enterprise uses · Malware S0268: Bisonal Enterprise uses · Malware S0060: Sys10 Enterprise uses · Malware S0081: Elise Enterprise uses · Malware S0141: Winnti for Windows Enterprise uses · Malware S0664: Pandora Enterprise uses · Malware S0128: BADNEWS Enterprise uses · Malware S0272: NDiskMonitor Enterprise uses · Group G0129: Mustang Panda Enterprise uses · Malware S1076: QUIETCANARY Enterprise uses · Malware S1085: Sardonic Enterprise uses · Group G0012: Darkhotel Enterprise uses · Malware S0438: Attor Enterprise
Mitigations

Mitigation direction

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
6728f3debf3486d1...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle 6728f3debf34…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  2. [2]
    mitre-attack T1573.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use