Several It malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another It malware sample XORs C2 traffic. Other It malware uses Caracachs encryption to encrypt C2 payloads. It has also used AES to encrypt C2 traffic.