## 5 Research Findings
### RQ1: What Techniques Are Utilized to Abuse the CPLS as C&C Communication Channels?  
Investigating and comprehending the specific strategies or methods employed by attackers to abuse CPLS for their C&C communication channels is essential for understanding the nature and extent of these attacks. The taxonomy of attack techniques presented in Table 5 showcases the wide range of methods utilized by threat actors to exploit CPLS for C&C operations. Each technique corresponds to a specific set of CPLS platforms that are targeted by threat actors for C&C activities. These techniques encompass diverse approaches, including concealing communication within seemingly legitimate files, using encoding to obscure commands or data, employing encryption for secure communication, creating fraudulent accounts, acquiring botmaster credentials or hard-coded tokens, compromising legitimate user accounts, hijacking COM components, AI-powered C&C, injecting malicious code into authorized processes, and modifying system variables. By gaining a comprehensive understanding of the specific techniques employed by attackers, valuable insights can be obtained regarding their tactics. These insights can then inform the development of effective countermeasures and proactive defense strategies to mitigate the risks associated with CPLS abuse in C&C operations.  
Figure 4: The number of included publications from pre-defined (**a**) academic and (**b**) industrial sources.  
\begin{table}
\begin{tabular}{l l l l l} \hline
**Technique** & **Abused CPLS** & **Description** & **Reference** & **Occurrences** \\ \hline Stegongography & Dropbox, Google Cloud Messaging (GCM), Discord, Facebook, Twitter, Image, Img8B, Evermore & Hiding communication between bots and C&& [18, 19, 20, 21] & 9 \\ \hline \multirow{4}{*}{Encoding} & webcom, Twitter, Facebook, Google Docs, Instagram, YouTube, Video, Ooera, GitHub, ouditvive, Dropbox, Google & Using encoding to make communications more difficult to detect, such as music at encoding used to obfuscate C& [20, 22, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53,  
Further exploration and analysis of these attack techniques can be found in Section 6.  
RQ2: How Frequently Are These Attack Techniques Employed and Which Types of CPLS Are Targeted for Such Abuse?  
Evaluating the frequency and prevalence of attack techniques used to exploit CPLS as C&C channels is crucial for understanding their popularity and effectiveness. Based on the information presented in Table 5, these attack techniques have been observed and documented across multiple references, indicating their use to varying degrees. However, obtaining precise quantitative data on the frequency of these techniques can be challenging due to the clandestine nature of cybercriminal operations and the ever-evolving threat landscape. Consequently, we acknowledge that these references may not encompass the entire spectrum of cyber threats associated with abusing CPLS. Despite this, the comprehensive list of references presented in Table 5 and the count of abuses by year for each technique illustrated in Figure 5 emphasize the importance of paying attention to these techniques.