Procedure examples

TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.

BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.

During the initial Pikabot command and control check-in, Pikabot will transmit collected system information encrypted using RC4.

Spark has exfiltrated data over the C2 channel.

Bumblebee can send collected data in JSON format to C2.

BRICKSTORM has uploaded files from the victim system to C2 servers.

Amadey has sent victim data to its C2 servers.

Proxysvc performs data exfiltration over the control server channel using a custom protocol.

Torisma can send victim data to an actor-controlled C2 server.

Stuxnet sends compromised victim information via HTTP.

RotaJakiro sends device and other collected data back to the C2 using the established C2 channels over TCP.

KOPILUWAK has exfiltrated collected data to its C2 via POST requests.

Misdat has uploaded files and data to its C2 servers.

HAWKBALL has sent system information and files over the C2 channel.

Ursnif has used HTTP POSTs to exfil gathered information.

ZLib has sent data and files from a compromised host to its C2 servers.

InvisibleFerret has used HTTP communications to the “/Uploads” URI for file exfiltration.

Bankshot exfiltrates data over its C2 channel.

SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.

StrongPity can exfiltrate collected documents through C2 channels.

AppleSeed can exfiltrate files via the C2 channel.

PowerExchange can exfiltrate files via its email C2 channel.

Emotet has exfiltrated data over its C2 channel.

Crimson can exfiltrate stolen information over its C2.

Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.

DUSTTRAP can exfiltrate collected data over C2 channels.

BADHATCH can exfiltrate data over the C2 channel.

Machete's collected data is exfiltrated over the same channel used for C2.

PingPull has the ability to exfiltrate stolen victim data through its C2 channel.

Woody RAT can exfiltrate files from an infected machine to its C2 server.

Mafalda can send network system data and files to its C2 server.

Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.

HexEval Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.

ShrinkLocker will exfiltrate victim system information along with the encryption key via an HTTP POST.

SombRAT has uploaded collected data and files from a compromised host to its C2 server.

ODAgent can use an attacker-controlled OneDrive account to receive C2 commands and to exfiltrate files.

FlawedAmmyy has sent data collected from a compromised host to its C2 servers.

HOPLIGHT has used its C2 channel to exfiltrate data.

Cuckoo Stealer can send information about the targeted system to C2 including captured passwords, OS build, hostname, and username.

MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.

RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.

Data exfiltration is done by Okrum using the already opened channel with the C2 server.

TRANSLATEXT has exfiltrated collected credentials to the C2 server.

Line Dancer exfiltrates collected data via command and control channels.

Mispadu can sends the collected financial data to the C2 server.

Doki has used Ngrok to establish C2 and exfiltrate data.

HTTPTroy has exfiltrated encrypted data over the C2 channel using the `up <FILENAME>` command.

MarkiRAT can exfiltrate locally stored data via its C2.

PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.