Procedure examples

Andariel has collected large numbers of files from compromised network systems for later extraction.

CURIUM has exfiltrated data from a compromised machine.

APT39 has used various tools to steal files from the compromised host.

APT37 has collected data from victims' local systems.

OilRig has used PowerShell to upload files from compromised systems.

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.

Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.

Ke3chang gathered information and files from local directories for exfiltration.

APT1 has collected files from a local victim.

Turla RPC backdoors can upload files from victim machines.

RedCurl has collected data from the local disk of compromised hosts.

Stealth Falcon malware gathers data from the local victim system.

APT29 has stolen data from compromised hosts.

Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.

MirrorFace gathered data and files of interest from victim's systems.

BRONZE BUTLER has exfiltrated files stolen from local systems.

Axiom has collected data from a compromised network.

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.

ToddyCat has run scripts to collect documents from targeted hosts.

LuminousMoth has collected files and data from compromised machines.

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.

Fox Kitten has searched local system resources to access sensitive documents.

Lazarus Group has collected data and files from compromised networks.

LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.

Wizard Spider has collected data from a compromised host prior to exfiltration.

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.

VOID MANTICORE has collected cached data and files from within the victim environment.

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.

TrickBot collects local files and information from the victim’s local machine.

BLINDINGCAN has uploaded files from victim machines.

RCSession can collect data from a compromised host.

QuietSieve can collect files from a compromised host.

Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.

BRICKSTORM has commands that allow the actor download files from the compromised host to the C2 server, and to also download specific sections of a file.

Amadey can collect information from a compromised host.

Proxysvc searches the local system and gathers data.

yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.

KOPILUWAK can gather information from compromised hosts.

Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.

Misdat has collected files and data from a compromised host.

Ursnif has collected files from victim machines, including certificates and cookies.

CASTLETAP can execute a C2 command to transfer files from victim machines.

ThreatNeedle can collect data and files from a compromised host.

Havoc can download files from the victim's computer.

FrameworkPOS can collect elements related to credit card data from process memory.

GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.

InvisibleFerret has collected data utilizing a script that contained a list of excluded files and directory names and naming patterns of interest such as environment and configuration files, documents, spreadsheets, and other files that contained the words secret, wallet, private, and password.