TACTIC: COMMAND AND CONTROL
Encrypted Channel (T1573): Real Cases
MITRE Definition ↗ Adversaries encrypt C2 traffic using symmetric or asymmetric encryption to evade inspection.
Key Facts
Technique ID
T1573
Command and Control
Mapped Cases
1
Primary sources
Related Laws
2
Criminal statutes
- ATT&CK Technique Identifier: T1573.
- Tactical Phase: Command and Control.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
charged 2024-05-07
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
Primary Source Evidence Excerpt: Indictment ¶ 15, Page 8
"C2 communications between infected hosts and the LockBit backend utilized custom AES-256 encrypted channels over TCP port 443."
U.S. District Court for the District of New Jersey · 2:24-cr-00330
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(5)(A)
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
18 U.S.C. § 1030(a)(7)
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.