While reading another story of botnet takedown, my wondering has reached its apogee: Why don't malware authors use cryptography (encryption + signing) provided by good libraries when their creations communicate with C&C servers?
Benefits are obvious, while the cost of integration is relatively low (isn't it?). If one would consider OpenSSL, it was founded in 1998, but I haven't heard about malware signing and encrypting at least some of its commands until ~2008.
A good example is Waledac botnet, which was taken down by Microsoft.
UPDATE: I found out that Conficker(2008) worm actually used payload signing and surprisingly in the end it downloaded Waledac.