Procedure examples

During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.

BlackByte transmitted collected victim host information via HTTP POST to command and control infrastructure.

GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.

APT3 has a tool that exfiltrates data over the C2 channel.

Kimsuky has exfiltrated data over its C2 channel.

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.

MuddyWater has used C2 infrastructure to receive exfiltrated data.

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.

Sandworm Team has sent system information to its C2 server using HTTP.

CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.

Mustang Panda has exfiltrated stolen data and files to its C2 server.

ZIRCONIUM has exfiltrated files via the Dropbox API C2.

Scattered Spider has exfiltrated data from compromised VMware vCenter servers through an established C2 channel using the Teleport remote access tool.

APT39 has exfiltrated stolen victim data through C2 communications.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

Higaisa exfiltrated data over its C2 channel.

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.

Confucius has exfiltrated stolen files to its C2 server.

Leviathan has exfiltrated data over its C2 channel.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.

Chimera has used Cobalt Strike C2 beacons for data exfiltration.

LuminousMoth has used malware that exfiltrates stolen data to its C2 server.

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.

VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.

WIRTE has exfiltrated collected victim data to C2 infrastructure.

TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.

BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.

During the initial Pikabot command and control check-in, Pikabot will transmit collected system information encrypted using RC4.

Spark has exfiltrated data over the C2 channel.

Bumblebee can send collected data in JSON format to C2.

BRICKSTORM has uploaded files from the victim system to C2 servers.

Amadey has sent victim data to its C2 servers.

Proxysvc performs data exfiltration over the control server channel using a custom protocol.

Torisma can send victim data to an actor-controlled C2 server.

Stuxnet sends compromised victim information via HTTP.

RotaJakiro sends device and other collected data back to the C2 using the established C2 channels over TCP.

KOPILUWAK has exfiltrated collected data to its C2 via POST requests.

Misdat has uploaded files and data to its C2 servers.

HAWKBALL has sent system information and files over the C2 channel.

Ursnif has used HTTP POSTs to exfil gathered information.

ZLib has sent data and files from a compromised host to its C2 servers.

InvisibleFerret has used HTTP communications to the “/Uploads” URI for file exfiltration.

Bankshot exfiltrates data over its C2 channel.

SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.

StrongPity can exfiltrate collected documents through C2 channels.

AppleSeed can exfiltrate files via the C2 channel.

PowerExchange can exfiltrate files via its email C2 channel.