Procedure examples

BlackByte transmitted collected victim host information via HTTP POST to command and control infrastructure.

GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.

APT3 has a tool that exfiltrates data over the C2 channel.

Kimsuky has exfiltrated data over its C2 channel.

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.

MuddyWater has used C2 infrastructure to receive exfiltrated data.

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.

Sandworm Team has sent system information to its C2 server using HTTP.

CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.

Mustang Panda has exfiltrated stolen data and files to its C2 server.

ZIRCONIUM has exfiltrated files via the Dropbox API C2.

Scattered Spider has exfiltrated data from compromised VMware vCenter servers through an established C2 channel using the Teleport remote access tool.

APT39 has exfiltrated stolen victim data through C2 communications.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

Higaisa exfiltrated data over its C2 channel.

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.

Confucius has exfiltrated stolen files to its C2 server.

Leviathan has exfiltrated data over its C2 channel.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.

Chimera has used Cobalt Strike C2 beacons for data exfiltration.

LuminousMoth has used malware that exfiltrates stolen data to its C2 server.

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.

VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.

WIRTE has exfiltrated collected victim data to C2 infrastructure.