Procedure examples

SUGARDUMP has sent stolen credentials and other data to its C2 server.

Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.

LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration.

HotCroissant has the ability to download files from the infected host to the command and control (C2) server.

REvil can exfiltrate host and malware information to C2 servers.

Valak has the ability to exfiltrate data over the C2 channel.

OilBooster can use an actor-controlled OneDrive account for C2 communication and exfiltration.

Cyclops Blink has the ability to upload exfiltrated files to a C2 server.

TajMahal has the ability to send collected files over its C2.

Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.

IPsec Helper exfiltrates specific files through its command and control framework.

Solar can send staged files to C2 for exfiltration.

GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.

AshTag has exfiltrated reconnaissance data on targeted systems to C2 servers.

Carberp has exfiltrated data via HTTP to already established C2 servers.

MacMa exfiltrates data from a supplied path over its C2 channel.

FunnyDream can execute commands, including gathering user information, and send the results to C2.

SysUpdate has exfiltrated data over its C2 channel.

OutSteel can upload files from a compromised host over its C2 channel.

LAMEHUG can exfiltrate collected system information and documents to C2.

Mango can use its HTTP C2 channel for exfiltration.

Kessel has exfiltrated information gathered from the infected system to the C2 server.

GrimAgent has sent data related to a compromise host over its C2 channel.

PHASEJAM has the ability to exfiltrate data from the victim appliance.

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.

CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.

PoetRAT has exfiltrated data over the C2 channel.

Penquin can execute the command code do_upload to send files to C2.

Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.

CreepySnail can connect to C2 for data exfiltration.

Troll Stealer exfiltrates collected information to its command and control infrastructure.

Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's `known_host` files and `wtmp` records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command `Xcat` to send the process's ssh session's credentials to the C2 server.

njRAT has used C2 infrastructure to receive stolen information from the infected machine including screenshots and other system information.

Manjusaka data exfiltration takes place over HTTP channels.

IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.

Shai-Hulud has used POST to exfiltrate secrets from the victim environment to an attacker-controlled URL.

metaMain can upload collected files and data to its C2 server.

SideTwist has exfiltrated data over its C2 channel.

MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.

Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.

Mis-Type has transmitted collected files and data to its C2 server.

XCSSET retrieves files that match the pattern defined in the INAME_QUERY variable within the user's home directory, such as `*test.txt`, and are below a specific size limit. It then archives the files and exfiltrates the data over its C2 channel.

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.

AppleJeus has exfiltrated collected host information to a C2 server.

STARWHALE can exfiltrate collected data to its C2 servers.

Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.

Kevin can send data from the victim host through a DNS C2 channel.

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.

Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.

Astaroth exfiltrates collected information from its r1.log file to the external C2 server.