Procedure examples

Kimsuky has exfiltrated data to C2 servers using an automated script that executes every 10 minutes and after successful checks for the presence of pre-designated staged filenames.

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.

Sidewinder has configured tools to automatically send collected files to attacker controlled servers.

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

RedCurl has used batch scripts to exfiltrate data.

StrongPity can automatically exfiltrate collected documents to the C2 server.

Hannotog can upload encyrpted data for exfiltration.

CosmicDuke exfiltrates collected files automatically over FTP to remote servers.

Machete’s collected files are exfiltrated automatically to remote servers.

Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.

Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.

LightNeuron can be configured to automatically exfiltrate files under a specified directory.

Peppy has the ability to automatically exfiltrate files and keylogs.

When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.

Crutch has automatically exfiltrated stolen files to Dropbox.

StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.

USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.

TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.

Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.

Solar can automatically exfitrate files from compromised systems.

OutSteel can automatically upload collected files to its C2 server.

If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.

ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.

Empire has the ability to automatically send collected data back to the threat actors' C2.

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to scan.aquasecurtiy[.]org. If that method fails it attempts to use a stolen GITHUB_TOKEN to create a repo and exfiltrate the data there.

Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.

Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.

Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.

Stuxnet can propagate via peer-to-peer communication and updates using RPC.

Kivars has the ability to remotely trigger keyboard input and mouse clicks.

MacMa can manage remote screen sessions.

Brute Ratel C4 has the ability to use RPC for lateral movement.

During Cutting Edge, threat actors used RDP with compromised credentials for lateral movement.

During C0018, the threat actors opened a variety of ports to establish RDP connections, including ports 28035, 32467, 41578, and 46892.

During Operation Digital Eye, threat actors moved laterally using RDP.

During C0015, the threat actors used RDP to access specific network hosts of interest.

During HomeLand Justice, threat actors primarily used RDP for lateral movement in the victim environment.

During the C0032 campaign, TEMP.Veles utilized RDP throughout an operation.

During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.

During APT28 Nearest Neighbor Campaign, APT28 used RDP for lateral movement.

During the 2025 Poland Wiper Attacks, adversaries utilized RDP to log into jump hosts and then moved laterally to other victim devices to include a domain controller.

Indrik Spider has used RDP for lateral movement.

BlackByte has used RDP to access other hosts within victim networks.

APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.

Kimsuky has used RDP for direct remote point-and-click access.

Volt Typhoon has moved laterally to the Domain Controller via RDP using a compromised account with domain administrator privileges.

Patchwork attempted to use RDP to move laterally.