## 6 Abuse Attack Techniques
### Steganography
#### 6.1.1 CPLS as a Primary C&C Communication Channel  
ELISA (Elusive Social Army) [18] is an OSN-based botnet that abuses Facebook as a covert C&C channel, disseminating its messages through victims' social media accounts. ELISA establishes a covert channel using a Unicode steganography technique, inserting non-printable characters and invisible glyphs into user-generated messages posted on OSNs. These hidden elements are not displayed during the rendering process, making them hard to detect. Stegobot [19], another OSN-based botnet, abuses Facebook as its main C&C communication channel. To establish this covert communication path within the social network, Stegobot employs a JPEG image steganography scheme known as YASS [50]. By doing so, it effectively embeds hidden information within digital images, thereby augmenting its stealth and evasion capabilities. Pumobot [22], a mobile botnet targeting Android systems, cleverly utilizes Google Cloud Messaging (GCM) for its C&C operations. Punobot employs a steganography technique that transforms the original command messages into different ones to evade detection by both users and the push notification service (PNS) server. HAMMERTOSS [21] is a backdoor developed by the APT29 threat-active community. HAMMERTOSS was well crafted to cover the tracks of APT29 using several techniques, including building an algorithm that produces regular Twitter handles and the steganographic embedding of images with malicious commands. HAMMERTOSS also uses a domain generation algorithm (DGA) to create new Twitter handles. Whenever the malware creates a new handle, the corresponding Twitter page is fetched, and the page is searched for a particular pattern, which represents the encrypted C&C URL. HAMMERTOSS utilizes GitHub and cloud storage services as the primary C&C communication channels to transmit commands and relay stolen data from compromised networks. To obtain the malicious commands, HAMMERTOSS implements steganography techniques through images that contain encrypted malicious commands. Once HAMMERTOSS obtains the GitHub URL from its regular Twitter account, it visits the page, retrieves the steganographic images containing encrypted data, and upon successful connection and downloading, begins the decryption process to extract the actual command and perform the intended malicious operation. RegDuke [20] malware employs steganography and cryptography techniques to hide data in PNG images. The developer of RegDuke misuses Dropbox by hosting steganography images containing an encrypted malicious command for covert C&C operations. The backdoor lists the Dropbox directory corresponding to a clientId (the compromised machine) and downloads the embedded PNG files. When images from the Dropbox directory are downloaded, the RegDuke code scans through all the image pixels and extracts data from them. The hidden data are specifically extracted from the implant, and the content is decrypted using an advanced encryption standard (AES) key that is hard-coded in the payload, which can be one of the following weapons of attack: Windows executable, Windows DLL, or PowerShell script. This backdoor only resides in memory and relies on steganography to hide data in images using a technique called \"least significant bit\", which stores and combines 8 bits of data into a total of 24 bits of data per pixel: 8 for red, 8 for green, and 8 for blue. RegDuke consists of a loader and a payload, both components written in.NET. RegDuke persists byusing a WMI consumer named MicrosoftOfficeUpdates. The threat technical report [20] identifies four different primary variants of the RegDuke loader between August 2017 and June 2019. The first version was not obfuscated and had the encryption key hard-coded in the code. Later versions directly read the encryption key from the Windows registry and employed various obfuscation techniques, such as flattening the control flow or using.NET Reactor, a commercial obfuscator. In 2012, [PERSON] et al.