I recently came across a topic of network steganography, mostly connected with modifying the headers of IP, TCP, ICMP. I was looking for some real-world examples of malware that uses it. I only found two ICMP related examples - Nanolocker and Pingback. But I have a hard time finding ones connected with IP and TCP.
Do you know any examples?