T1573: Encrypted Channel
AI Answer
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files. (Source: MITRE ATT&CK T1573)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1573 |
| Name | Encrypted Channel |
| Tactic | Command and Control (command-and-control) |
| Platforms | ESXi, Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Encrypted Channel (T1573) is one of the highest-connectivity ATT&CK techniques: 17 MITRE STIX relationships reference this technique; 4 threat groups observed using it; 11 software families associated; 2 campaigns associated; 1 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1573). Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- RCSession
- NETWIRE
- Gomir
- Emotet
- PowerLess
- Chaes
- gh0st RAT
- Cryptoistic
- MacMa
- PowGoop
- Lizar
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Tropic Trooper
- BITTER
- APT29
- Magic Hound
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- KV Botnet Activity
- Triton Safety Instrumented System Attack
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1573 Encrypted Channel. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1573 Encrypted Channel?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.