Several  malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another  malware sample XORs C2 traffic.  malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, evading SSL man-in-the-middle decryption attacks.