Activity timeline
T1573.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 20 reports, and 90 of the 90 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1573.002 Asymmetric Cryptography is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix, as a sub-technique of T1573 Encrypted Channel. Threadlinqs maps 90 of 2623 tracked threats (3.4%) to it; by severity that is 23 critical, 61 high, 6 medium.
Threats that use T1573.002 most often also use T1071.001 Web Protocols (74 threats), T1082 System Information Discovery (57 threats), T1027 Obfuscated Files or Information (56 threats), T1036.005 Match Legitimate Resource Name or Location (56 threats), T1041 Exfiltration Over C2 Channel (52 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
50 tracked threat actors appear in the threats that use T1573.002; the most frequent are APT38 (4), TeamPCP (4), APT28 (3), Andariel (3), Cavern Manticore (3).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1573.002.
Data sources
Telemetry that can reveal T1573.002, per MITRE ATT&CK.
- Network Traffic — Network Traffic Content
Threat actors using it
Tracked threats
The 30 most recent of 90 tracked threats that use T1573.002.
- Infostealer Market Resilience: Law Enforcement Takedowns Displace, Not Eliminate…medium
- PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistencehigh
- DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules…high
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoorshigh
- indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()high
- Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense…critical
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and…medium
- Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C…medium
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chainhigh
- Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi…high
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industryhigh
- npm Supply-Chain Compromise: @7nohe/openapi-react-query-codegen Ships "Trinitite" Credential-Harvesting Wormcritical
- Khmer Shadow: Amber Saolao cluster targets Cambodian government with NIGHTFORGE loader and Havoc Demonhigh
- Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via…critical
- Balonx Sistema PhaaS Campaign — AI Voice Calls and Fake Banking Pages Targeting Mexican Financial Institutionshigh
- Crimeware-as-a-Service: Inside the Malware Crypting Services Market and Its Threat Actorshigh
- CVE-2026-54876 — OpenSSL Client-Side Memory Leak in OCSP Response Checking (Denial of Service)high
- 'ChainDrop' self-propagating worm compromises hundreds of popular npm packages (keyv, cacheable ecosystem)…critical
- Pre-Release Domain Abuse Campaign Targets GTA 6 (Grand Theft Auto VI) — 922 Malicious Domains Across…high
- CaptiveCrunch: Midnight Blizzard (Storm-2945) Hospitality Captive-Portal AiTM Campaignhigh
- CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver…high
- BlackTech Deploys BlueShell Linux Backdoor Against Japanese Organizationshigh
- STAC4749 Campaign: Microsoft Teams Vishing Leads to Chaos Ransomware Deploymenthigh
- msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to Chaos Ransomware RaaShigh
- Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar…high
- EtherHiding on macOS: Blockchain-Resolved C2 via Polygon Smart Contracthigh
- Royal Ransomware Uses Qbot and Cobalt Strike to Rapidly Compromise Windows Domainshigh
- HollowGraph Malware Abuses Microsoft 365 Calendar as Covert C2 Channel (Cavern Framework, Suspected Cavern…high
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar…high
- HollowGraph Malware Abuses Microsoft Graph API and M365 Calendar Events (Future-Dated 2050) for Stealthy…high
Detection coverage
Threadlinqs maintains 231 detection rules mapped to T1573.002 (SPL 94, KQL 67, Sigma 70). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1573 Encrypted Channel — 364 tracked threats at the technique level.