Newer variants ofBACKSPACE will encode C2 communications with a custom system.^[3]

Bankshot encodes commands from the control server using a range of characters and gzip.^[4]

CHIMNEYSWEEP can use a custom Base64 alphabet for encoding C2.^[5]

Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.^[6]

InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.^[7]

Lizar has used a complex XOR operation to obfuscate C2 communications.^[8]

Neo-reGeorg can use modified Base64 encoding to obfuscate communications.^[9]

NightClub has used a non-standard encoding in DNS tunneling removing any= from the result of base64 encoding, and replacing/ characters with-s and+ characters with-p.^[10]

Ninja can encode C2 communications with a base64 algorithm using a custom alphabet.^[11]

OceanSalt can encode data with a NOT operation before sending the data to the control server.^[12]

PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.^[13]

RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.^[14]

ShadowPad has encoded data as readable Latin characters.^[15]

Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.^[16][17]

TONESHELL has encoded a payload with a random 32-byte key using XOR.^[18]TONESHELL has also encoded payloads with a 256-byte key using XOR.^[19]

Uroburos can use a custom base62 and a de-facto base32 encoding that uses digits 0-9 and lowercase letters a-z in C2 communications.^[20]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.

A process/script constructs or references a custom/alphabet translation table (e.g., 64/85/32+ arbitrary chars, XOR/base-N loops) or emits long high-entropy strings that do NOT validate as standard Base64/Hex → shortly after, the same process (or its child) generates outbound traffic with asymmetric bytes_out:bytes_in, fixed-size beacons, or protocol/header mismatches (e.g., Content-Type says JSON but body fails JSON parse / contains non-standard alphabet).

Shell scripts or binaries implement custom mapping tables (tr/sed/awk/golang/rust/python encode loops), or emit long high-entropy tokens that fail Base64/Hex validation → correlated with egress showing asymmetric flow, protocol-mismatch payloads, or DNS/HTTP bodies containing low-diversity-but-long custom alphabets.

EndpointSecurity/Unified Logs show processes generating custom alphabets or long high-entropy, non-standard tokens → network logs (PF/Zeek/EDR) show asymmetric beacons, protocol mismatches, or periodic fixed-size posts.

ESXi shell or scripts produce long, high-entropy tokens (non-standard alphabets) in shell.log/hostd, followed by outbound flows (NSX/Zeek) with asymmetric ratios or protocol mismatches to non-management endpoints.