Explore Steganography

Cryptography locks the door. Steganography removes the door from the map. They solve different problems against different adversaries — and conflating them is one of the most persistent gaps in security thinking. Here, you work through what that distinction actually means in practice: threat models, detection surface, operational context, and why APT28, Lazarus, and TA558 kept reaching for stego-laced payloads in 2023–2025 when encrypted C2 was already available to them.

The technical ground covers more than images. LSB embedding in JPEGs is where most courses stop; the teaching guide here doesn't let you stop there. Network steganography — DNS tunneling, protocol timing channels — accounts for a majority of real-world stegomalware cases, and GAN-based hiding has quietly crossed from academic novelty to operational standard, achieving 84%+ misclassification rates against ML detectors. You build understanding across that whole range, including why no detection method works universally and what a layered SOC playbook actually looks like when encrypted traffic hides the payload from boundary inspection.

None of this is framed as pass-or-fail. Nugget asks you questions, waits for your reasoning, and pushes back when the reasoning skips a step. If you assume Steghide's password prompt means the file is secure, that assumption gets tested — specifically, against what Stegseek and rockyou.txt do to it. If you think detection is deterministic, the probabilistic reality of chi-square tests and UEBA baselines earns its own thread. You steer the session; the concepts respond to where your thinking actually is.