Procedure examples

NETEAGLE is capable of reading files over the C2 channel.

CHIMNEYSWEEP can upload collected files to the command-and-control server.

Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.

Chrommme can exfiltrate collected data via C2.

Flagpro has exfiltrated data to the C2 server.

To exfiltrate data, LightSpy configures each module to send an obfuscated JSON blob to hardcoded URL endpoints or paths aligned to the module name.

GoldMax can exfiltrate files over the existing C2 channel.

Line Runner utilizes HTTP to retrieve and exfiltrate information staged using Line Dancer.

Pteranodon exfiltrates screenshot files to its C2 server.

BeaverTail has exfiltrated data collected from victim devices to C2 servers.

ROKRAT can send collected files back over same C2 channel.

Dyre has the ability to send information staged on a compromised host externally to C2.

PlugX has exfiltrated stolen data and files to its C2 server.

Bisonal has added the exfiltrated data to the URL over the C2 channel.

S-Type has uploaded data and files from a compromised host to its C2 servers.

Lumma Stealer has exfiltrated collected data over existing HTTP and HTTPS C2 channels.

DustySky has exfiltrated data to the C2 server.

LightNeuron exfiltrates data over its email C2 channel.

DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.

Mongall can upload files and information from a compromised host to its C2 server.

SVCReady can send collected data in JSON format to its C2 server.

ThiefQuest exfiltrates targeted file extensions in the /Users/ folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.

FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.

Caterpillar WebShell can upload files over the C2 channel.

Latrodectus can exfiltrate encrypted system information to the C2 server.

LODEINFO can exfiltrate collected credentials and browser cookies to the C2 server.

CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.

MuddyViper has uploaded files to the C2 server. Additionally, MuddyViper has the ability to upload the specified file in chunks with sleep time between each chunk.

EVILNUM can upload files over the C2 channel from the infected host.

SMOKEDHAM has exfiltrated data to its C2 server.

Sagerunex encrypts collected system data then exfiltrates via existing command and control channels.

Metamorfo can send the data it collects to the C2 server.

Bandook can upload files from a victim's machine over the C2 channel.

MagicRAT exfiltrates data via HTTP over existing command and control channels.

KONNI has sent data and files to its C2 server.

DnsSystem can exfiltrate collected data to its C2 server.

BLUELIGHT has exfiltrated data over its C2 channel.

KGH_SPY can exfiltrate collected information from the host to the C2 server.

RedLine Stealer has sent victim data to its C2 server or RedLine panel server.

OopsIE can upload files from the victim's machine to its C2 server.

Attor has exfiltrated data over the C2 channel.

LitePower can send collected data, including screenshots, over its C2 channel.

BoxCaon uploads files and data from a compromised host over the existing C2 channel.

NightClub can use SMTP and DNS for file exfiltration and C2.

Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).

SDBbot has sent collected data from a compromised host to its C2 servers.

StrelaStealer exfiltrates collected email credentials via HTTP POST to command and control servers.

Grandoreiro can send data it retrieves to the C2 server.

Drovorub can exfiltrate files over C2 infrastructure.

Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.