OilRig Hides C2 Configuration in Google Drive Image Using LSB Steganography

Cybersecuritynews •Tushar Subhra Dutta • April 28, 2026

A well-known Iranian state- hacking group called OilRig, also tracked as APT34 and Helix Kitten, has been found hiding its command-and-control (C2) server configuration inside a regular-looking image file stored on Google Drive. The threat group used a technique called LSB (Least Significant Bit) steganography to quietly embed encrypted data into a PNG image, making […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OilRig Uses LSB Steganography to Conceal C2 Configurations in Google Drive Images The Iranian APT group OilRig, also known as APT34 and Helix Kitten, has launched a new attack campaign utilizing LSB (Least Significant Bit) steganography to hide command-and-control (C2) configurations within PNG images stored on Google Drive. This sophisticated method allows the group to embed encrypted data within seemingly innocuous image files, making detection challenging. OilRig primarily targets sectors such as government, energy, telecommunications, and finance, indicating a broad potential impact across critical infrastructures. The group has been active since at least 2014, and this recent tactic highlights their evolving strategies in cyber operations. There are no specific CVEs or tools mentioned in the articles, but the use of steganography represents a significant advancement in their operational security. As of now, the full scope of the impact remains unclear, but the stealthy nature of the attack raises concerns among cybersecurity professionals. 2 sources 57

OilRig Hides C2 Configuration in Google Drive Image Using LSB Steganography

The full story

Extracted Entities

APT Groups (3)

Tools (1)