## 6 Abuse Attack Techniques
### Botmaster Login Credentials or Hard-Coded Token  
#### 6.4.1 CPLS as Primary C&C Communication Channel  
[PERSON] [30, 66] identified a Twitter account, named \"upd4t3\", that was being maliciously utilized as a C&C operations hub. The botmaster used this account to distribute Base64-encoded commands via tweets. The bot then fetched these commands using the RSS (really simple syndication) feed, decoded them, and executed them, thus establishing a covert C&C communication route. [PERSON] et al. [31] developed an OSN-based botnet named SocialNetworkingBot that leverages Twitter for its C&C communications. The malware author used authenticated official Twitter accounts to post tweets containing disguised commands to be interpreted by the bots. The botmaster posted tweets using approximately 300 pre-defined keywords to facilitate fetching the tweets. Bots queried the Twitter search engine for specific keywords to retrieve these tweets from the botmaster account, which served as a rendezvous point. The bots then fetched and executed the malicious commands embedded in these tweets. Telecrypt [87, 107] is a type of ransomware that abuses Telegram's instant messaging API for its C&C infrastructure. Initially, the botmaster sets up a Telegram bot, which utilizes TeleCrypt ransomware to enable interaction between the threat actors and the compromised machine. Upon infecting a machine, the ransomware employs Telegram's'sendMessage' method. This method enables the bot to transmit messages to a chat thread associated with a specific number. This number is hard-coded into the ransomware's body, and is used to deliver a \"successful infection\" report back to the attackers. This is performed using the following request:  
[[https://api.telegram.org/bot](https://api.telegram.org/bot)]([https://api.telegram.org/bot](https://api.telegram.org/bot))<token>/sendmessage?chat_id=<chat>  
&text=<computer_name>_<infection_id>_<key_seed>  
The request includes the following parameters:  
* <chat>: Represents the chat number with the cybercriminal. * <computer_name>: The name of the infected computer. * <infection_id>: A unique identifier for the infection. * <key_seed>: A number used as the basis for generating the file encryption key. Following the transmission of this information, the trojan scans the infected machine's hard drives, looking for files with specific extensions. Once such files are identified, they are encrypted bytewise. This encryption is achieved by adding each file byte to the corresponding key bytes, employing a simple encryption algorithm. ESET researchers have uncovered a unique malicious toolkit, TeleBot.AA [13], developed by the TeleBots APT group. This toolkit was specifically designed to abuse Telegram for C&C operations, utilizing the Telegram Bot API. Each version of the backdoor contains individual hard-coded credentials, indicating the presence of a Telegram Messenger account for each sample. The attacker communicates with the compromised systems through private Telegram chats, enabling the exchange of commands and retrieval of results. Palo Alto Networks has detailed in an article [88] a malicious Android trojan known as \"TeleRAT\". This trojan abuses the Bot API of Telegram to carry out C&C activities. The TeleRAT spyware infiltrates the victim's Telegram app by masquerading as a legitimate application that promises to provide a count of profile visitors. The APKs of the malicious app contain hard-coded Telegram bot API keys, enabling them to periodically send beaconing signals at precise intervals of 4.6 s and await specific commands from the attacker. TrendMicro [54] recently discovered a malware variant named BKDR_VERNOT.A that employs a clever technique to avoid detection. This malware utilizes legitimate services like Evernote, a web-based note-taking application, as a proxy server to establish communication with the botmaster.