Procedure examples

Emotet has exfiltrated data over its C2 channel.

Crimson can exfiltrate stolen information over its C2.

Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.

DUSTTRAP can exfiltrate collected data over C2 channels.

BADHATCH can exfiltrate data over the C2 channel.

Machete's collected data is exfiltrated over the same channel used for C2.

PingPull has the ability to exfiltrate stolen victim data through its C2 channel.

Woody RAT can exfiltrate files from an infected machine to its C2 server.

Mafalda can send network system data and files to its C2 server.

Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.

HexEval Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.

ShrinkLocker will exfiltrate victim system information along with the encryption key via an HTTP POST.

SombRAT has uploaded collected data and files from a compromised host to its C2 server.

ODAgent can use an attacker-controlled OneDrive account to receive C2 commands and to exfiltrate files.

FlawedAmmyy has sent data collected from a compromised host to its C2 servers.

HOPLIGHT has used its C2 channel to exfiltrate data.

Cuckoo Stealer can send information about the targeted system to C2 including captured passwords, OS build, hostname, and username.

MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.

RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.

Data exfiltration is done by Okrum using the already opened channel with the C2 server.

TRANSLATEXT has exfiltrated collected credentials to the C2 server.

Line Dancer exfiltrates collected data via command and control channels.

Mispadu can sends the collected financial data to the C2 server.

Doki has used Ngrok to establish C2 and exfiltrate data.

HTTPTroy has exfiltrated encrypted data over the C2 channel using the `up <FILENAME>` command.

MarkiRAT can exfiltrate locally stored data via its C2.

PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.

NETEAGLE is capable of reading files over the C2 channel.

CHIMNEYSWEEP can upload collected files to the command-and-control server.

Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.

Chrommme can exfiltrate collected data via C2.

Flagpro has exfiltrated data to the C2 server.

To exfiltrate data, LightSpy configures each module to send an obfuscated JSON blob to hardcoded URL endpoints or paths aligned to the module name.

GoldMax can exfiltrate files over the existing C2 channel.

Line Runner utilizes HTTP to retrieve and exfiltrate information staged using Line Dancer.

Pteranodon exfiltrates screenshot files to its C2 server.

BeaverTail has exfiltrated data collected from victim devices to C2 servers.

ROKRAT can send collected files back over same C2 channel.

Dyre has the ability to send information staged on a compromised host externally to C2.

PlugX has exfiltrated stolen data and files to its C2 server.

Bisonal has added the exfiltrated data to the URL over the C2 channel.

S-Type has uploaded data and files from a compromised host to its C2 servers.

Lumma Stealer has exfiltrated collected data over existing HTTP and HTTPS C2 channels.

DustySky has exfiltrated data to the C2 server.

LightNeuron exfiltrates data over its email C2 channel.

DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.

Mongall can upload files and information from a compromised host to its C2 server.

SVCReady can send collected data in JSON format to its C2 server.

ThiefQuest exfiltrates targeted file extensions in the /Users/ folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.