## 6 Abuse Attack Techniques
### Cryptography  
#### 6.3.1 CPLS as a Primary C&C Communication Channel  
[PERSON] et al. [118] introduce SUbot, a botnet specifically designed for mobile platforms. SUbot leverages micro-blogging for evasion purposes and implements cryptography using RC4 to conceal a secret message. This message, which contains a malicious command, is appended to the end of a JPG file. Following this, the author of SUbot uploads the modified JPG file, which now contains an executable command, to a blog. When an infected mobile device visits the URL of the site, it downloads the image and retrieves the encrypted commands from the JPG file. [PERSON] et al. [24] designed a botnet to conceal malicious commands within a tweet. In their proposed experiment, the Botmaster covertly injects encrypted malicious commands into tweets to evade security measures. The format of the malware-infected tweet follows the #keyword command pattern, where the value of the command is encrypted. The bot then retrieves the tweet from the Botmaster's fake Twitter accounts and extracts the provided encrypted command. This command is then decrypted and interpreted, launching an attack on the infected machine. [PERSON] et al. [67] constructed prototypes of web test automation rootkit (WTAR) bots: Fbbot, Twbot, and Wbbot. These bots abuse Facebook, Twitter, and Weibo, respectively, as C&C infrastructures. The web test automation (WTA) technique, initially developed for automating browsers and testing websites, can perform actions such as filling in forms, reading data from web pages, and clicking elements on web pages. The WTAR-based technique has been leveraged to mimic typical user behaviors on an OSN. To better conceal the communication, thus making detection more difficult, both the botmaster and the bot use the data encryption standard (DES) to encrypt the commands and their corresponding execution results using a predefined key. The Turla backdoor is a type of malware that exploits a victim's Outlook mailbox, using it as a transport layer for its C&C operations, receiving commands, and exfiltrating data. To better conceal the malicious commands and execution results, the designer of the Turla backdoor takes advantage of a previously opened session of the victim to gain access to the default mailbox profile [69]. In addition, the backdoor creator employs the MISTY1 symmetric encryption method. This method is used to create specially crafted PDF documents that contain either encrypted malicious instructions or confidential information, which are then attached to the compromised Outlook account's inbox. ESET researchers [70] investigated a backdoor variant called ComRAT, which abuses Gmail as a covert C&C channel to receive commands and exfiltrate data. The ComRAT botnet authorizes the Gmail account using credentials embedded in the malware payload. ComRAT then connects to the Gmail HTML web interface to search for an email with a specific subject. Once matched, the email attachment is downloaded and decrypted via the AES-256 algorithm to extract the malicious command for execution. The executed command result is then encrypted using RSA-2048 and emailed to the threat actor, often hosted on GMX or VFEmail. To ensure persistence, ComRAT developers rely on a technique known as COM hijacking to tamper with the Windows registry, causing the ComRAT botnet to execute every time the user logs in. RegDuke malware [20] utilizes cryptographic techniques to secure the data transmitted between the botmaster and the bots. Once an image is downloaded from Dropbox, the bot loops over the image pixels to extract data. The bot then decrypts the information with an AES key hard-coded in the payload to retrieve malicious commands. The CloudMe platform was exploited by CloudAtlas malware [72] as a covert communication channel. To make the transmitted messages between the attacker and the victim undetectable, the designer of the CloudAtlas malware employs cryptography with AES and data compression with LZMA techniques.