TACTIC: COMMAND AND CONTROL
Data Encoding (T1132): Real Cases
MITRE Definition ↗ Adversaries encode data with standard algorithms to make communications and metadata more difficult to inspect.
Key Facts
Technique ID
T1132
Command and Control
Mapped Cases
1
Primary sources
Related Laws
0
Criminal statutes
- ATT&CK Technique Identifier: T1132.
- Tactical Phase: Command and Control.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)
alleged 2020-12-13
Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.
Primary Source Evidence Excerpt: CISA Advisory AA20-352A ¶ 16
"SUNBURST encoded stolen domain information into custom Base64-like strings disguised as GUID query parameters."
U.S. District Court for the Southern District of New York · SEC CIK 0001739942
View full case dossier →