## 6 Abuse Attack Techniques
### Botmaster Login Credentials or Hard-Coded Token
#### 6.4.1 CPLS as Primary C&C Communication Channel
Upon successfully infecting the victim's machine, BKDR_VERNOT.A drops a.DLL file that injects itself into a genuine process, generating legitimate network traffic in order to evade detection by security solutions. The payload of BKDR_VERNOT.A leverages hard-coded official Evernote account credentials to connect to saved notes, enabling the backdoor to retrieve malicious commands and upload stolen data to a designated drop-off zone. TrendMicro researchers discovered and analyzed a backdoor called \"SLUB\", which abuses three legitimate platforms--Slack, GitHub, and File.io--to establish its C&C infrastructure [12]. The threat actor sets up a Slack workspace and a GitHub account to facilitate SLUB backdoor C&C operations. To interact with the Slack API, the designer of SLUB embeds two hard-coded authentication tokens. The operator of SLUB uploads malicious commands to GitHub snippets, which the backdoor then retrieves and executes. The results of these commands are subsequently uploaded to both Slack and File.io. TrendMicro researchers discovered a variant of the SLUB backdoor four months after the first version was identified [90]. This evolved version discontinued using GitHub for its C&C operations, instead opting to fully integrate Slack workspaces as the covert C&C communication channel between the malware and its controller. The updated SLUB variant employs the same authentication approach as the previous version between the backdoor and its controller. Once a victim machine is infected by the SLUB backdoor and attempts to join a Slack workspace, a new channel titled <use_name>-<pc_name> is created. If the SLUB threat actor wants to execute a malicious command, they post the message to a victim-specific channel in Slack. The SLUB backdoor on the victim's machine then responds by parsing and executing the requested command. The CloudAtlas malware exploited the CloudMe platform as a covert communication channel [72]. To secure the messages transmitted between the attacker and the victim and to make them undetectable, the designer of CloudAtlas employed a combination of AES cryptography and LZMA data compression techniques. The malware was configured to contain encrypted contents including the C&C's CloudMe URL, a username and password, and two folders on the CloudMe server designated for storing malicious commands and uploading the victim's data. Specifically, the botmaster uploads the encrypted malicious commands to the account, which the malware then downloads, decrypts, and interprets. The malware employs the same mechanism to upload the results back to the server. [PERSON] et al. [94] introduced C2 DM, an Android botnet architecture that abuses Google's Cloud to Device Messaging (C2 DM) service for the dissemination of C&C commands. C2 DM, a cloud-based push notification service for Android developers, was exploited in this botnet to eliminate the need for a direct connection between the botmaster and the bots. By blending the malicious bot traffic with the legitimate C2 DM traffic from other Android apps, this botnet can covertly transmit its traffic. Furthermore, [PERSON] et al. [94] highlighted that many existing botnet detection strategies struggle to detect this type of push-like mobile botnet, as both malicious bots and legitimate applications use official push servers to receive updates. [PERSON] et al. [23] developed CloudBot, an enhanced version of a push-styled botnet [23]. CloudBot is a hybrid structured smartphone botnet (combining hierarchical and P2P structures) that abuses ten cloud-based push services (GCM, JPush, XGPush, ZYPush, GeXinPush, and Airbop) as a C&C downstream channel. Meanwhile, prominent cloud services like Dropbox, OneDrive, and Google Drive are used as a C&C upstream channel. CloudBot's design allows botmasters to send commands to bots in the form of legitimate push traffic via cloud-based push services. The bot then uploads the extracted data using cloud-based storage services.