## 5 Research Findings
### RQ1: What Techniques Are Utilized to Abuse the CPLS as C&C Communication Channels?
#### 5.2.5 Anomaly Analysis  
There are notable anomalies, wherein some platforms report low abuse instances despite maintaining large user bases. For example, Instagram, with over 1.6 billion users, recorded merely a single instance of abuse as indicated in Figure 6. Conversely, platforms such as Dropbox, Twitter, Slack, Pastebin, and Telegram are outliers with a smaller user base but a high number of abuse occurrences. This can be attributed to the following factors:  
* Platform usage patterns: Different platforms cater to different user behaviors and usage patterns. For instance, platforms like Dropbox and Slack, despite having smaller user bases, often attract business and professional users. This can make them more appealing targets for abusers seeking access to sensitive information.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline  & & \multicolumn{3}{c}{**Incident Categories**} \\
**CPLS** & **Occurrences** & **Reported Abuse** & **PoC** \\ \hline Dropbox & 17 & [20,63,75,76,86,95,96,97,98] & [23,81,99,99,100,110] \\ Twitter & 13 & [20,21,30,39,66,85] & [24,28,31,32,48,67,111] \\ Google Docs & 8 & [35,41,50] & — \\ Google Drive & 8 & [39,51,54,64,77] & [23] \\ Youtube & 8 & [41,45,68,73,74] & — \\ Facebook & 8 & [33,61,68,107,108] & [18,19,67] \\ Slack & 7 & [12,90] & [79,91,92,112] \\ Outlook & 6 & [29,55,56,69,109] & [82] \\ OneDrive & 6 & [43,63,78,104,105] & [23] \\ Pastebin & 6 & [35,36,58,68,69,74] & — \\ Github & 6 & [12,247,49] & — \\ Gmail & 4 & [70] & [16,71,106] \\ Telegram & 4 & [13,87,88,107] & — \\ Google Cloud Messaging (GCM) & 3 & — & [22,23,94] \\ Evernote & 2 & [20,54,89] & — \\ Google Scripts & 2 & [35,36] & — \\ Discord & 2 & — & [25,26] \\ ImgBB & 2 & [20,39] & — \\ Microsoft TechNet & 1 & [57] & — \\ CloudMe & 1 & [72] & — \\ Imgur & 1 & [20] & — \\ Google+ & 1 & [58] & — \\ Facebook Instance Messenger & 1 & — & [61] \\ File.io & 1 & [12] & — \\ Yahoo & 1 & [46] & — \\ Quora & 1 & [46] & — \\ Microsoft Teams & 1 & — & [82] \\ Microsoft OneNote & 1 & — & [82] \\ Google Sites & 1 & [68] & — \\ Instagram & 1 & [29] & — \\ pCloud & 1 & [80] & — \\ Yandex Disk & 1 & [80] & — \\ Alibaba Cloud & 1 & [65] & — \\ Mega & 1 & [63] & — \\ Exchange Web Services (EWS) & 1 & [3] & — \\ \hline \hline \end{tabular}
\end{table}
Table 6: Malware occurrences grouped by CPLS: a reported abuse is for in-the-wild malware incident, whereas a PoC (proof of concept) is malware created by security researchers.  
* Security measures: The level of security measures implemented by the platforms plays a crucial role in the number of abuse occurrences. Platforms with robust security features and stringent user verification processes might experience fewer instances of abuse, even with a large user base.
* Platform features and accessibility: platforms that offer a broader range of functionality and ease of use tend to attract more abusers, which provides more opportunities and tools for abusers to exploit.
* Anonymity: platforms that offer a certain level of anonymity seem to attract abusers. This could be because anonymity can make it easier for abusers to avoid identification.