Procedure examples

Pillowmint has collected credit card data using native API functions.

MacMa can collect then exfiltrate files from the compromised system.

FunnyDream can upload files from victims' machines.

SysUpdate can collect information and files from a compromised host.

OutSteel can collect information from a compromised host.

PUNCHTRACK scrapes memory for properly formatted payment card data.

LAMEHUG has the ability to collect system information and files of interest from compromised systems.

GrimAgent can collect data and files from a compromised host.

StealBit can upload data and files to the LockBit victim-shaming site.

ZxShell can transfer files from a compromised host.

SLIGHTPULSE can read files specified on the local system.

SPAWNCHIMERA has extracted the device’s Linux kernel image (vmlinux).

Troll Stealer gathers information from infected systems such as SSH information from the victim's `.ssh` directory. Troll Stealer collects information from local FileZilla installations and Microsoft Sticky Note.

njRAT can collect data from a local system.

IceApple can collect files, passwords, and other data from a compromised host.

metaMain can collect files and system information from a compromised host.

SideTwist has the ability to upload files from a compromised host.

Mis-Type has collected files and data from a compromised host.

XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.

Octopus can exfiltrate files from the system using a documents collector tool.

STARWHALE can collect data from an infected local host.

Pcexter can upload files from targeted systems.

Kevin can upload logs and other data from a compromised host.

Pasam creates a backdoor through which remote attackers can retrieve files.

POWERSTATS can upload files from compromised hosts.

When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

Linfo creates a backdoor through which remote attackers can obtain data from local systems.

Goopy has the ability to exfiltrate documents from infected systems.

QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.

CookieMiner has retrieved iPhone text messages from iTunes phone backup files.

Gelsemium can collect data from a compromised host.

Dtrack can collect a variety of information from victim machines.

Zox has the ability to upload files from a targeted system.

UPPERCUT can upload files to the C2 from infected machines.

StrifeWater can collect data from a compromised host.

WarzoneRAT can collect data from a compromised host.

SLOTHFULMEDIA has uploaded files and information from victim machines.

NPPSPY records data entered from the local system logon at Winlogon to capture credentials in cleartext.

PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.

PcShare can collect files and information from a compromised host.

Brute Ratel C4 has the ability to upload files from a compromised system.

TruffleHog has gathered data from home directories of the victim environment.

Out1 can copy files and Registry data from compromised hosts.

Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).

MCMD has the ability to upload files from an infected device.

esentutl can be used to collect data from local file systems.

Koadic can download files off the target system to send back to the server.

QuasarRAT can retrieve files from compromised client machines.

Wevtutil can be used to export events from a specific log.

TeamPCP has stolen source code from victim environments including Mistral AI.