OilRig Hides C2 Configuration in Google Drive Image Using LSB Steganography

This report details an OilRig (APT34/Helix Kitten) campaign that used a malicious macro-enabled Excel file to compile a C# loader which retrieved a GitHub pointer to a Google Drive PNG containing LSB-steganography hidden, encrypted C2 configuration; the loader decoded the configuration (Telegram bot token, chat ID, and module URLs) and loaded five in-memory modules for persistence and data exfiltration, leveraging GitHub, Google Drive, and Telegram to evade detection.