Although the C2 traffic is secured by SSL/TLS, Karagany also encrypts and encodes the packet payloads before transmission to its C2 server using the AES-128-CBC algorithm and a pseudo-randomly generated initialization vector (IV) (see Figure 3