It has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. It has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.