Procedure examples

SMOKEDHAM has exfiltrated data to its C2 server.

Sagerunex encrypts collected system data then exfiltrates via existing command and control channels.

Metamorfo can send the data it collects to the C2 server.

Bandook can upload files from a victim's machine over the C2 channel.

MagicRAT exfiltrates data via HTTP over existing command and control channels.

KONNI has sent data and files to its C2 server.

DnsSystem can exfiltrate collected data to its C2 server.

BLUELIGHT has exfiltrated data over its C2 channel.

KGH_SPY can exfiltrate collected information from the host to the C2 server.

RedLine Stealer has sent victim data to its C2 server or RedLine panel server.

OopsIE can upload files from the victim's machine to its C2 server.

Attor has exfiltrated data over the C2 channel.

LitePower can send collected data, including screenshots, over its C2 channel.

BoxCaon uploads files and data from a compromised host over the existing C2 channel.

NightClub can use SMTP and DNS for file exfiltration and C2.

Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).

SDBbot has sent collected data from a compromised host to its C2 servers.

StrelaStealer exfiltrates collected email credentials via HTTP POST to command and control servers.

Grandoreiro can send data it retrieves to the C2 server.

Drovorub can exfiltrate files over C2 infrastructure.

Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.

SUGARDUMP has sent stolen credentials and other data to its C2 server.

Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.

LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration.

HotCroissant has the ability to download files from the infected host to the command and control (C2) server.

REvil can exfiltrate host and malware information to C2 servers.

Valak has the ability to exfiltrate data over the C2 channel.

OilBooster can use an actor-controlled OneDrive account for C2 communication and exfiltration.

Cyclops Blink has the ability to upload exfiltrated files to a C2 server.

TajMahal has the ability to send collected files over its C2.

Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.

IPsec Helper exfiltrates specific files through its command and control framework.

Solar can send staged files to C2 for exfiltration.

GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.

AshTag has exfiltrated reconnaissance data on targeted systems to C2 servers.

Carberp has exfiltrated data via HTTP to already established C2 servers.

MacMa exfiltrates data from a supplied path over its C2 channel.

FunnyDream can execute commands, including gathering user information, and send the results to C2.

SysUpdate has exfiltrated data over its C2 channel.

OutSteel can upload files from a compromised host over its C2 channel.

LAMEHUG can exfiltrate collected system information and documents to C2.

Mango can use its HTTP C2 channel for exfiltration.

Kessel has exfiltrated information gathered from the infected system to the C2 server.

GrimAgent has sent data related to a compromise host over its C2 channel.

PHASEJAM has the ability to exfiltrate data from the victim appliance.

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.

CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.

PoetRAT has exfiltrated data over the C2 channel.

Penquin can execute the command code do_upload to send files to C2.

Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.