Log in Request a demo

Attack technique

Encrypted Channel

Encrypted Channel is a technique where attackers encrypt the traffic they use to control a compromised system.

In short

Encrypted Channel is a technique where attackers encrypt the traffic they use to control a compromised system. The encryption hides what is being sent, so security tools that read network traffic see only scrambled data. MITRE ATT&CK tracks it as T1573 under Command and Control, and lists Emotet, gh0st RAT and NETWIRE as using it.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Command and Control · Step 13 Of 15 In The Attack Chain

  1. MITRE IDT1573ATT&CK technique
  2. Detection4ways to spot itLopsided traffic · Encryption on unusual ports
  3. Defences2ways to stop itSSL/TLS inspection

How it works

After an attacker gains a foothold, the infected system needs to talk to a server the attacker controls. This is called command and control. If that traffic is readable, a network tool can match it against known patterns.

To avoid this, attackers encrypt the traffic with an encryption algorithm of their own choosing instead of relying only on the protection built into a normal protocol. Defenders then cannot easily read the commands or the data going out.

The method has a weakness. If the secret keys are stored or generated inside the malware or its configuration files, analysts who take the malware apart may be able to recover them.

MITRE lists two sub-techniques: T1573.001 Symmetric Cryptography and T1573.002 Asymmetric Cryptography.

A real example

MITRE ATT&CK lists these procedure examples:

  • Emotet has encrypted data before sending it to its command server.
  • gh0st RAT has encrypted its TCP communications to avoid detection.
  • NETWIRE can encrypt its command and control communications.

How to detect

  1. Unexpected programs using encryption on the network

    Watch for processes that do not normally make network connections but open outbound encrypted sessions, especially to rare destinations or with non-standard certificate chains.

  2. Lopsided traffic

    Look for encrypted sessions where the client sends much more than it receives, or the reverse, which can differ from normal browsing patterns.

  3. Encryption on unusual ports

    Flow records or packet inspection can show encrypted traffic on ports that do not normally carry it, with high-entropy data.

  4. Detection strategy MITRE lists

    DET0273, Detection Strategy for Encrypted Channel across OS Platforms.

How to defend

  1. SSL/TLS inspection

    Inspecting encrypted sessions lets defenders look for network signs of malware communication that would otherwise stay hidden.

  2. Network intrusion detection and prevention

    Systems that use network signatures can help identify traffic from specific malware at the network level.

Questions

What is the Encrypted Channel technique?

It is a technique where attackers encrypt the traffic between a compromised system and their own server. Defenders then cannot easily read the commands or the data going out. MITRE ATT&CK tracks it as T1573 under Command and Control.

How can defenders detect an encrypted command channel?

Watch for processes that do not normally use the network but open outbound encrypted sessions to rare destinations. Lopsided traffic, where the client sends far more than it receives, and encryption on unusual ports are also warning signs.

How do you defend against Encrypted Channel attacks?

Use SSL/TLS inspection to look inside encrypted sessions for signs of malware communication. Network intrusion detection and prevention systems with signatures can also help identify traffic from specific malware.

Why is encrypted attacker traffic hard to stop?

Encryption stops network tools from matching the traffic against known patterns. It has a weakness, though: if the secret keys are stored inside the malware or its configuration, analysts who take the malware apart may be able to recover them.

In our research

  1. GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. Akira ransomware advisory AA24-109A: stages and tools October 2026
  3. UAC-0102: Inside a Covert Espionage Operation Targeting Ukraine and Beyond March 2026
  4. Kasablanka: The Emerging North African Cyber Threat Actor March 2026
  5. MuddyWater: Iran-Linked Espionage Group Expanding Global Reach November 2025
  6. Telegram Leaks and Dark Channels: How Criminals Use Telegram October 2025

Sources

  1. MITRE ATT&CK T1573: Encrypted Channel MITRE
  2. MITRE ATT&CK TA0011: Command and Control MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT28

The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165). MITRE says the group has been active since at least 2004, and government advisories describe espionage against governments, militaries, political parties, media and logistics firms.

Read more

Threat group

BITTER

MITRE ATT&CK describes BITTER as a suspected South Asian cyber espionage group, active since at least 2013, that has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia. It sends spearphishing emails with malicious attachments and exploits known flaws in Microsoft Office.

Read more