Procedure examples

GrimAgent has sent data related to a compromise host over its C2 channel.

PHASEJAM has the ability to exfiltrate data from the victim appliance.

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.

CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.

PoetRAT has exfiltrated data over the C2 channel.

Penquin can execute the command code do_upload to send files to C2.

Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.

CreepySnail can connect to C2 for data exfiltration.

Troll Stealer exfiltrates collected information to its command and control infrastructure.

Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's `known_host` files and `wtmp` records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command `Xcat` to send the process's ssh session's credentials to the C2 server.

njRAT has used C2 infrastructure to receive stolen information from the infected machine including screenshots and other system information.

Manjusaka data exfiltration takes place over HTTP channels.

IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.

Shai-Hulud has used POST to exfiltrate secrets from the victim environment to an attacker-controlled URL.

metaMain can upload collected files and data to its C2 server.

SideTwist has exfiltrated data over its C2 channel.

MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.

Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.

Mis-Type has transmitted collected files and data to its C2 server.

XCSSET retrieves files that match the pattern defined in the INAME_QUERY variable within the user's home directory, such as `*test.txt`, and are below a specific size limit. It then archives the files and exfiltrates the data over its C2 channel.

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.

AppleJeus has exfiltrated collected host information to a C2 server.

STARWHALE can exfiltrate collected data to its C2 servers.

Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.

Kevin can send data from the victim host through a DNS C2 channel.

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.

Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.

Astaroth exfiltrates collected information from its r1.log file to the external C2 server.

QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.

Adversaries can direct BACKSPACE to upload files to the C2 Server.

ADVSTORESHELL exfiltrates data over the same channel used for C2.

StrifeWater can send data and files from a compromised host to its C2 server.

WarzoneRAT can send collected victim data to its C2 server.

SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.

XORIndex Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

ShimRatReporter sent generated reports to the C2 via HTTP POST requests.

Sliver can exfiltrate files from the victim using the download command.

SILENTTRINITY can transfer files from an infected host to the C2 server.

Empire can send data gathered from a target through the command and control channel.

PcShare can upload files and information from a compromised host to its C2 servers.

Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.

Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.

TeamPCP Cloud Stealer has exfiltrated collected data to typosquat C2 domains including scan.aquasecurtiy[.]org.

Mini Shai-Hulud has exfiltrated encrypted archives over C2 domains.

During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to enumerate internal network services and endpoints across targeted environments using browser automation via MCP, including databases, container registries, admin interfaces, and workflow orchestration platforms.

During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.

During the 2025 Poland Wiper Attacks, the adversaries utilized Ping, the Advanced Port Scanner and Advanced IP Scanner to enumerate network devices.

During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.

During C0027, used RustScan to scan for open ports on targeted ESXi appliances.